Skip to content

Siemphony is in beta and still being built. What ships today, and what does not.

Siemphonybeta
Ramil Namazov’s repertoire

Shell interpreter opening an external network connection

Ramil Namazov@ramil-namazovhighT1059.004unverified
A shell interpreter that initiates an outbound connection to a non-private address has the shape of a reverse shell. The internal filter keeps routine administrative traffic out so the rule stays quiet on normal estate activity.Full description

The detection

The 2 SIEM queries below are previews produced by Siemphony’s own translator, not pySigma, and none has been executed against a real backend — review before you deploy.

detection.yml

Splunk · SPL

Run this as a search.

index=* (((Image="*/bash" OR Image="*/sh" OR Image="*/python3") AND Initiated="true") AND NOT ((DestinationIp="10.*" OR DestinationIp="192.168.*" OR DestinationIp="172.16.*")))

Wazuh · XML rule

Deploy to your manager — this is a rule, not a search.

<group name="sigma,linux,network_connection,">  <!-- Rule ids must be unique on your manager; 100000+ is the user range. -->  <rule id="100000" level="12">    <!-- Set <if_sid> to the decoder/base rule for linux so this only evaluates relevant events. -->    <field name="Image" type="pcre2">(?i)(/bash$|/sh$|/python3$)</field>    <field name="Initiated" type="pcre2">(?i)^true$</field>    <field name="DestinationIp" negate="yes" type="pcre2">(?i)(^10\.|^192\.168\.|^172\.16\.)</field>    <description>Shell interpreter opening an external network connection</description>    <mitre>      <id>T1059.004</id>    </mitre>  </rule></group>

Sentinel · KQL

Run this as a search.

Sentinel cannot express this construct. `Initiated` has no Sentinel column: Defender expresses connection direction in `ActionType`, not as a boolean column, so `Initiated` cannot be renamed — it needs a different predicate. The Sigma source is on the first tab, unchanged.

Elastic · ES|QL

Run this as a search.

Elastic cannot express this construct. `Initiated` has no ECS field: ECS expresses connection direction as `network.direction` with values like `egress`, not as a boolean, so `Initiated` needs a different predicate rather than a rename. The Sigma source is on the first tab, unchanged.

Verdicts · reactions · comments

Community

Verdicts from engineers who actually deployed it, and the conversation around it.

Log in to react
Not yet reported on

Nobody has run this in a real environment and said what happened.

Verdicts from engineers who deployed it

0 cast

No verdicts reported yet. The first one is worth more than the tenth — say what you ran it against.

Log in to report a verdict.

Log in to join the discussion.

3 threads

  • @priya-raman

    filter_internal covers `172.16.` only, but RFC 1918 runs from 172.16 to 172.31 — so 172.17 upward is treated as external. That is Docker's default bridge range, which means any container on the host talking outbound through a shell gives you a steady drip of false positives that look exactly like a reverse shell. A `172.` prefix would over-match public space, so the honest fix is the sixteen explicit second octets, or a CIDR match if the backend supports one.

    • @nadia-brandt

      Also `/python3` but not `/python`, `/perl`, `/ruby` or `/node`, and a reverse shell one-liner in any of those is a two-minute search away. I am not arguing for a longer list — every entry costs noise and the short one is defensible — but the gap deserves a line in the description, so nobody reads a quiet rule as a clean estate.

  • Deleted by its author.
  • Deleted by its author.
    • Deleted by its author.