The following analytic detects outbound network connections originating from Netcat or Netcat-like binaries on Linux systems. Netcat is a versatile networking utility that, while legitimate in some contexts, is frequently abused by attackers to establish reverse shells, exfiltrate data, or create persistent backdoor connections to remote systems. This activity is significant because outbound connections from these binaries often indicate an active compromise, where an attacker may be maintaining command-and-control communication or tunneling malicious traffic. If confirmed malicious, this could lead to unauthorized data exfiltration, lateral movement, or persistent remote access to the compromised system.

0 exclusive techniques.This is coverage no other published rule has; it is not this rule's total technique count.