Living-off-the-Land Data Exfiltration
Instead of using dedicated malware to steal data, an attacker can repurpose tools that are already installed and trusted on a machine — git, ssh, openssl, Python's built-in web server, netcat — to move data out or open a covert tunnel. This rule watches for those tools being used with the specific flags that turn them from normal utilities into a data pipeline.
How the attack works
An attacker with access to a host (or an AI agent tricked into running commands) uses a built-in tool instead of dropping new software, which avoids raising alarms about unknown binaries. Examples include SSH port-forwarding to relay traffic through the host, openssl opening a raw encrypted connection to send data, Python's http.server exposing a directory of files to the network, netcat piping data to a remote listener, or git adding a remote pointing to an outside server and pushing repository contents to it. The rule also watches subprocess execution, so it still catches these actions when a tunnel is opened by a process spawned by something else, not just top-level commands. For git specifically, it only flags pushes to hosts outside the organisation's known forges, not normal internal development pushes.
Netzilo detection
Netzilo reports this behaviour when it is observed.
- Signature ID
- af74dcc8-c033-5847-a7c9-a3f6eb0ef3b4
- Severity
- Medium
Why it matters
An organisation can lose source code, credentials, or other sensitive files without any dedicated exfiltration malware ever touching disk, because the traffic looks like ordinary developer or admin activity.
What you can do
- →Restrict outbound network access from servers and build hosts to known destinations, blocking unexpected SSH tunnels, raw TLS sockets, or HTTP servers.
- →Review and allowlist the git remotes and forge hosts your organisation actually uses, and alert on pushes to anything outside that list.
- →Audit use of ssh -L/-R, openssl s_client, netcat, and python -m http.server in production or sensitive environments, and require justification for legitimate uses like bastion access or local previews.
- →Log and monitor subprocess creation on sensitive hosts, not just top-level shell commands, since tunnels are often launched by a spawned child process.
Known benign look-alikes
- Developers using ssh -L to reach a database or service through a bastion host
- python -m http.server used to preview static site output locally
- openssl s_client used to debug a TLS handshake or inspect a certificate
- git push to a self-hosted forge not listed in filter_known_forge