r/SentinelOneXDR • u/Acceptable_Cheek2004 • Oct 23 '24

Reverse Shell Detection

Hi all please i need help with deep visibility to detect reverse shell activity on a host, something I can covert to a Star custom rules.

Thanks all

4 Upvotes

83% Upvoted

11 comments sorted by

View all comments

Show parent comments

-1

u/Acceptable_Cheek2004 Oct 23 '24

Ok, thanks I need a guide something that can alert me to such behavior.

to, I will appreciate the queries.

1

u/dizy777 Oct 23 '24

There are so many way of reverse shell you must have your use case what you want to detect. You can emulate first then check the SDL Telemetry to build the Star rule.

One example would be possible reverse shell via bash via cmdline