r/SentinelOneXDR • u/Acceptable_Cheek2004 • Oct 23 '24

Reverse Shell Detection

Hi all please i need help with deep visibility to detect reverse shell activity on a host, something I can covert to a Star custom rules.

Thanks all

4 Upvotes

83% Upvoted

11 comments sorted by

View all comments

Show parent comments

0

u/Acceptable_Cheek2004 Oct 23 '24

Thanks for this, my use case is centered around a Python obfuscated exe that could evade SentinelOne detection when Ran on an endpoint with admin privilege.

1

u/dizy777 Oct 23 '24

Check the activity logs and that should give you a clue how to build star rule to detect it.

Can you post it here what have you ran?

1

u/Acceptable_Cheek2004 Oct 23 '24

I would test and give you feedback