Loading story…
Splunk published a new analytic to detect Linux reverse shells that abuse shell pseudo-devices such as /dev/tcp and /dev/udp to open outbound connections from bash, sh, dash, or zsh without requiring tools like netcat. The detection, Linux Shell Pseudo Device Reverse Shell, is designed for Splunk Enterprise Security and uses EDR or Sysmon for Linux process telemetry mapped into the CIM Endpoint Processes data model to identify shell redirection patterns commonly used after compromise for remote access and command execution.
The analytic is mapped to MITRE ATT&CK techniques T1048.003 and T1059, linking the behavior to exfiltration over unencrypted non-C2 protocols and command-shell abuse. MITRE documents broad adversary use of alternative outbound protocols—including HTTP, FTP, SMTP, DNS, WebDAV, TCP, and TFTP—for data theft and covert transfer, as well as the use of legitimate utilities such as curl, ftp, WinSCP, and Rclone. Splunk said the detection generates intermediate risk events by default and warned that legitimate administrative diagnostics or testing can also trigger it, making environment-specific filtering important.
See real exploitation activity before you spend the cycle.
2 events from the most recent confirmed update back to the earliest known activity.
Splunk published or updated the "Linux Shell Pseudo Device Reverse Shell" analytic in Splunk Enterprise Security. The detection identifies shell use of /dev/tcp or /dev/udp to establish outbound connections and maps to ATT&CK techniques T1048.003 and T1059.
MITRE ATT&CK published the Enterprise sub-technique page for T1048.003, Exfiltration Over Unencrypted Non-C2 Protocol, documenting examples of threat groups, malware, and utilities that exfiltrate data over alternative unencrypted protocols.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
2 references tracked. Mallory keeps watching after this page renders.
research.splunk.com
Open sourceattack.mitre.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Splunk has removed its deprecated **"Network Connection Discovery With Net"** analytic and replaced it with **"Windows Network Connection Discovery Via Net"**, updating the detection logic for suspicious use of `net.exe` and `net1.exe` on Windows systems. The analytic is designed to surface command-line activity associated with **MITRE ATT&CK `T1049`**, which covers adversary reconnaissance of active network connections, open ports, sessions, and reachable resources after initial compromise. MITRE documents `T1049` as a common post-compromise behavior used by APT groups, ransomware operators, and malware families to map local network connectivity through utilities such as `netstat`, `net use`, and `net session`, as well as Windows networking APIs. Splunk said the detection relies on telemetry including **Sysmon Event ID 1**, **Windows Security Event ID 4688**, and **CrowdStrike ProcessRollup2** normalized into the Splunk Endpoint data model, and noted that while the activity can indicate reconnaissance supporting lateral movement or data exfiltration, administrators may also trigger it during legitimate troubleshooting.
Aug 12, 2026
Splunk has published a new analytic to detect exploitation of the Linux kernel local privilege escalation flaw known as **Dirty Frag**, tied to `CVE-2026-43284` and `CVE-2026-43500`. The detection maps to MITRE ATT&CK technique `T1548.001` for abuse of setuid and setgid mechanisms, and is designed to identify attackers escalating privileges from an unprivileged Linux process to root. The analytic looks for a distinctive exploit chain in Linux `auditd` telemetry: a burst of `splice()` or `vmsplice()` syscalls from a process launched from a user-writable path, followed within five minutes by execution of a **setuid** binary in the same audit session. Splunk said the detection is intended for Splunk Enterprise Security, is disabled by default, and requires Linux `auditd` data with audit rule keys for `splice_user` and `process_creation`; it also warned that high-I/O legitimate workloads may need tuning or allowlisting because the threshold was calibrated against the public V4bel proof of concept.
Jul 16, 2026
Splunk released an Enterprise Security analytic to detect `socat` processes that pair `exec:` with `-listen:` arguments, a pattern that can bind an executable to inbound TCP or OpenSSL connections. The resulting listener can provide a bind shell, remote command execution, lateral movement, or command-and-control (C2) tunneling. The detection generates notable findings and risk events from endpoint process telemetry; defenders should tune it for legitimate development, debugging, protocol testing, and network-troubleshooting activity. Protocol tunneling remains a widely used ATT&CK technique (`T1572`) for concealing C2 within common services and protocols, including SSH, DNS/DoH, HTTP CONNECT, SOCKS, TLS, and reverse-tunnel platforms such as ngrok. Recent investigations illustrate the risk: REF0657 used iox, Rakshasa, and ICMP tunneling during a financial-services intrusion, while SOMNIRECORD disguised C2 and exfiltration as DNS TXT queries. Elastic also observed suspicious macOS activity in which a coding agent preceded Cloudflare Quick Tunnel use, an ngrok alert, and LaunchAgent persistence, underscoring the need to investigate tunnel creation and persistence even when trusted developer tools initiate them.
Sep 10, 2026