IMPORTANT: No additional bug fixes or documentation updates will be released for this version. For the latest information, see the current release documentation.
« Net command via SYSTEM account Network Connection via Certutil »
Elastic Docs ›Elastic Security Solution [7.14] ›Detections and alerts ›Prebuilt rule reference

Netcat Network Activity

edit

Netcat Network Activity

edit

A netcat process is engaging in network activity on a Linux host. Netcat is often used as a persistence mechanism by exporting a reverse shell or by serving a shell on a listening port. Netcat is also sometimes used for data exfiltration.

Rule type: eql

Rule indices:

  • auditbeat-*
  • logs-endpoint.events.*

Severity: medium

Risk score: 47

Runs every: 5 minutes

Searches indices from: now-9m (Date Math format, see also Additional look-back time)

Maximum alerts per execution: 100

References:

Tags:

  • Elastic
  • Host
  • Linux
  • Threat Detection

Version: 6 (version history)

Added (Elastic Stack release): 7.6.0

Last modified (Elastic Stack release): 7.12.0

Rule authors: Elastic

Rule license: Elastic License v2

Potential false positives

edit

Netcat is a dual-use tool that can be used for benign or malicious activity. Netcat is included in some Linux distributions so its presence is not necessarily suspicious. Some normal use of this program, while uncommon, may originate from scripts, automation tools, and frameworks.

Rule query

edit
sequence by process.entity_id [process where (process.name == "nc"
or process.name == "ncat" or process.name == "netcat" or
process.name == "netcat.openbsd" or process.name ==
"netcat.traditional") and event.type == "start"] [network where
(process.name == "nc" or process.name == "ncat" or process.name ==
"netcat" or process.name == "netcat.openbsd" or
process.name == "netcat.traditional")]

Rule version history

edit
Version 6 (7.12.0 release)
  • Formatting only
Version 5 (7.10.0 release)

  • Updated query, changed from:

    event.category:network and event.type:(access or connection or start)
and process.name:(nc or ncat or netcat or netcat.openbsd or
netcat.traditional)
Version 4 (7.9.1 release)
  • Formatting only
Version 3 (7.9.0 release)

  • Updated query, changed from:

    process.name:(nc or ncat or netcat or netcat.openbsd or
netcat.traditional) and event.action:(bound-socket or connected-to or
socket_opened)
Version 2 (7.7.0 release)

  • Updated query, changed from:

    process.name: (nc or ncat or netcat or netcat.openbsd or
netcat.traditional) and event.action: (connected-to or bound-socket or
socket_opened)
« Net command via SYSTEM account Network Connection via Certutil »