Reverse Shell Generator
Port selection defeats port blocking, not behavioural analysis. A server initiating a long-lived outbound connection is backwards, and that stays true no matter which port the attacker picks.
Open in Red Team Toolkit — revshellReverse Shell Generator
What the attacker produced
The Reverse Shell Generator produced a one-liner that, when executed on a target, causes that host to initiate an outbound connection back to the attacker and hand over an interactive shell. The key behavioural signature is directionality: a server-class host initiating a long-lived outbound connection to an external IP is backwards. This anomaly persists regardless of which port, protocol, or encoding the attacker uses.
Port selection defeats port blocking, not behavioural analysis. A server initiating a long-lived outbound connection is backwards, and that stays true no matter which port the attacker picks.
Telemetry generated
| Log source | Field / identifier | What it shows |
|---|---|---|
| auditd / Sysmon-for-Linux | execve / SYSCALL | Process execution records showing the reverse shell one-liner — /dev/tcp redirects, nc with -e, mkfifo pipe patterns, or Python/Perl/Ruby socket one-liners. |
| Sysmon Event 3 | DestinationIp / DestinationPort / Image | Network connection event with the owning process. Correlating the process that opened the connection with the command line that spawned it gives you the full chain. |
| NetFlow / NDR | Duration / Direction / ByteRatio | A server-subnet host initiating a long-lived outbound connection with roughly symmetric byte counts (interactive shell traffic) is behaviourally backwards and is the most durable signal — it survives port and protocol changes. |
Detection rules
title: Reverse Shell One-Liner Patterns
id: d5e6f7a8-b9c0-1234-defa-123456789012
status: stable
description: Detects common reverse shell one-liner patterns on Linux hosts
references:
- https://attack.mitre.org/techniques/T1059/004/
author: Cal Security & Forensics
date: 2026/08/05
tags:
- attack.execution
- attack.t1059.004
logsource:
category: process_creation
product: linux
detection:
selection_devtcp:
CommandLine|contains:
- '/dev/tcp/'
- '/dev/udp/'
selection_nc:
Image|endswith: '/nc'
CommandLine|contains: ' -e '
selection_python:
Image|endswith:
- '/python'
- '/python3'
CommandLine|contains|all:
- 'socket.socket'
- 'subprocess'
selection_mkfifo:
CommandLine|contains|all:
- 'mkfifo'
- '|sh -i'
condition: 1 of selection_*
falsepositives:
- Authorised penetration testing (suppress by source IP during approved windows)
level: highEvasion & counters
Using port 443 to blend with permitted HTTPS egress and evade port-based firewall rules.
Detect the absent TLS handshake (Suricata rule above) and the direction anomaly — a server initiating a long-lived outbound connection is backwards regardless of port. Port choice does not change the behavioural signature.
Wrapping the shell in real TLS via openssl s_client to pass the TLS header check.
JA3 fingerprinting identifies the TLS client fingerprint — openssl s_client has a distinctive JA3 hash. Flow duration and direction anomalies persist: a server-initiated long-lived TLS session to an unknown external IP is still suspicious.
Using a legitimate Remote Monitoring and Management (RMM) tool as the C2 channel to blend with approved remote access traffic.
Baseline your approved RMM agents by binary hash and network destination. An unapproved RMM binary or an approved binary connecting to an unapproved destination is itself the detection signal.
Rule tuning
Preventive control
Apply default-deny egress filtering from server subnets — a reverse shell to an unapproved destination simply cannot connect. Maintain an allowlist of approved external destinations for each server role (patch servers, telemetry endpoints, CDN ranges) and block everything else. This is the single most effective control: no egress path means no shell.