Techniques
Sample rules
Linux Netcat Outbound Connection
- source: splunk
- technicques:
Description
The following analytic detects outbound network connections originating from Netcat or Netcat-like binaries on Linux systems. Netcat is a versatile networking utility that, while legitimate in some contexts, is frequently abused by attackers to establish reverse shells, exfiltrate data, or create persistent backdoor connections to remote systems. This activity is significant because outbound connections from these binaries often indicate an active compromise, where an attacker may be maintaining command-and-control communication or tunneling malicious traffic. If confirmed malicious, this could lead to unauthorized data exfiltration, lateral movement, or persistent remote access to the compromised system.
Detection logic
| tstats `security_content_summariesonly`
count min(_time) as firstTime
max(_time) as lastTime
from datamodel=Network_Traffic.All_Traffic where
All_Traffic.app IN (
"*nc",
"*ncat",
"*netcat"
)
All_Traffic.direction="outbound"
by All_Traffic.src All_Traffic.dest All_Traffic.dest_port All_Traffic.transport
All_Traffic.process_name All_Traffic.app All_Traffic.user All_Traffic.process_id
| `drop_dm_object_name(All_Traffic)`
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
| `linux_netcat_outbound_connection_filter`