LoFP LoFP / legitimate system administrators or developers may use netcat for troubleshooting, port scanning, or testing network connectivity. filter based on known administrative activity or authorized users.

Techniques

Sample rules

Linux Netcat Outbound Connection

Description

The following analytic detects outbound network connections originating from Netcat or Netcat-like binaries on Linux systems. Netcat is a versatile networking utility that, while legitimate in some contexts, is frequently abused by attackers to establish reverse shells, exfiltrate data, or create persistent backdoor connections to remote systems. This activity is significant because outbound connections from these binaries often indicate an active compromise, where an attacker may be maintaining command-and-control communication or tunneling malicious traffic. If confirmed malicious, this could lead to unauthorized data exfiltration, lateral movement, or persistent remote access to the compromised system.

Detection logic


| tstats `security_content_summariesonly`
  count min(_time) as firstTime
        max(_time) as lastTime

from datamodel=Network_Traffic.All_Traffic where

All_Traffic.app IN (
    "*nc",
    "*ncat",
    "*netcat"
)
All_Traffic.direction="outbound"

by All_Traffic.src All_Traffic.dest All_Traffic.dest_port All_Traffic.transport
   All_Traffic.process_name All_Traffic.app All_Traffic.user All_Traffic.process_id


| `drop_dm_object_name(All_Traffic)`

| `security_content_ctime(firstTime)`

| `security_content_ctime(lastTime)`

| `linux_netcat_outbound_connection_filter`