# Reverse Shell Attempt

- **Severity:** Critical
- **Signature ID:** `74dee137-ffb8-54c8-862f-4a98a61f63ee`
- **MITRE ATLAS:** AML.T0072 (Reverse Shell)
- **OWASP:** ASI07 (Unsafe Autonomous Code Execution)

## Summary

This detects commands that try to open a remote, interactive shell connection back to an attacker-controlled machine. It watches for known reverse-shell patterns built with common tools like bash, python, perl, netcat (nc), and socat.

## How the attack works

An attacker who has already gained some ability to run commands on a system (for example through a compromised AI agent) issues a command that connects out to a listener they control. Common forms use bash's /dev/tcp redirection, python or perl one-liners that spawn a shell over a socket, or netcat/socat piping a shell's input and output over the network. Once the connection succeeds, the attacker gets an interactive shell on the victim host, as if they were sitting at a terminal. This gives them a foothold to explore the system, escalate privileges, or move further into the network.

## Why it matters

A successful reverse shell gives an attacker hands-on-keyboard access to the compromised host, which can lead to data theft, further compromise of connected systems, or persistent backdoor access.

## What you can do

- Restrict outbound network connections from agent hosts to only the destinations they need; block unexpected outbound TCP connections to unfamiliar IPs or ports.
- Review command execution logs for use of /dev/tcp, netcat, socat, or scripting-language one-liners that open sockets and spawn shells.
- Limit what commands or shell access an AI agent or automation process is allowed to execute, and run it with the least privilege necessary.
- When you see a flagged reverse shell pattern, check whether it matches a known debugging or training activity before treating it as routine, since netcat connectivity tests can look similar.

## Known benign look-alikes

- Legitimate network debugging scripts using netcat for connectivity testing
- Security training exercises involving controlled reverse shell demonstrations

## References

- https://attack.mitre.org/techniques/T1059/
- https://attack.mitre.org/techniques/T1573/
- https://arxiv.org/abs/2403.04783

---
Source: https://www.netzilo.com/threats/reverse-shell