Reverse shell patterns
A command resembles a shell connected to another process or remote endpoint.
Why it is risky
Section titled “Why it is risky”A remotely controlled shell can let an external party execute commands with the agent process permissions.
Example
Section titled “Example”A compromised instruction asks an agent to start a shell that connects back to an unfamiliar remote host.
This is a fictional example, not an event from a customer.
What Omnodex Detects
Section titled “What Omnodex Detects”The rule matches selected shell, netcat, Python, and socat command forms associated with reverse shells. It also scans recognized staged scripts.
| Rule ID | Event category | Tier | Base severity |
|---|---|---|---|
RULE_THREAT_REVERSE_SHELL | threat_command | Community | CRITICAL |
Base severity is the rule default. A finding involving content saved for later execution may have a lower severity. Your loaded rule version and event details determine the finding you see.
What to check next
Section titled “What to check next”Check the destination and whether the activity was explicitly authorized. If an unexpected connection ran, isolate the affected environment and review commands and account access.
False positives
Section titled “False positives”Authorized penetration testing or a local process-bridging test can match. Some socat command forms can serve legitimate automation.
False negatives
Section titled “False negatives”Different reverse-shell implementations, renamed tools, compiled payloads, or hidden subprocess activity can be missed.
Technical details
Section titled “Technical details”The base severity is CRITICAL. Matching text is a high-consequence signal, but a tool invocation alone does not prove a working remote session.
A finding describes a pattern in captured activity. Review the original call, its result, and the task context before concluding that harm occurred. Absence of a finding does not establish that an operation is safe.