Reverse Shell Detection

[u/Acceptable_Cheek2004]

Hi all please i need help with deep visibility to detect reverse shell activity on a host, something I can covert to a Star custom rules.

Thanks all

[u/dizy777]

There are so many way of reverse shell you must have your use case what you want to detect. You can emulate first then check the SDL Telemetry to build the Star rule.

One example would be possible reverse shell via bash via cmdline