Reverse-shell style handshake

c2_reverse_shell_handshake

Opens a raw TCP connection to a controlled host and exchanges shell-flavoured text over it — a prompt, a command name, a response — without any shell being involved at either end. This is what deep packet inspection is expected to recognise on a non-HTTP conversation.

Severity high how bad it would be if it were real

Expected outcome Something should prevent it

Platforms 3 macOS, Linux, Windows

Isolation subprocess runs in its own process, so a kill is a measurement

What it needs before it will run

runs in --safe
Observation only. It runs even in the inert mode, because it changes nothing and sends nothing.
sends traffic
Generates outbound traffic. --no-network suppresses it entirely.

Gates are cumulative and none of them is implied by another: see the three gates for why they are separate decisions.

ATT&CK techniques it exercises

MITRE ATT&CK techniques this test maps to.
Technique	Name	Tactic	Across public reports
T1059.004	Unix Shell	Execution	coverage statistics
T1571	Non-Standard Port	Command and Control	coverage statistics

How often anything notices

Not enough data: fewer than 3 public reports have run this test, so no rate is published for it. Groups below that threshold are withheld everywhere on the site — with one or two contributors an average is one organisation's result with a percent sign after it.

Other network and c2 tests

Other tests in the Network and C2 category.
Test	What it does	Severity
Beaconing pattern to a controlled endpoint c2_beacon_pattern	Sends a series of small, jittered HTTPS requests to a single endpoint with an attacker-shaped user agent and an opaque base64 body, producing the regu…	high
Outbound traffic to Tor directory authorities tor_node_egress	Attempts TCP connections to the Tor network's published directory authorities. Reaching them means an endpoint on this network could bootstrap Tor and…	high
Fetching an onion service tor_onion_fetch	Looks for a Tor SOCKS proxy on this host and, if one is listening, performs a full SOCKS5 handshake and fetches a published onion service through it. …	high
Egress on non-standard ports c2_nonstandard_ports	Attempts outbound TCP connections on the ports malware habitually uses — 4444, 1337, 8080, 8443, 31337, 6667 — against a public service that answers o…	medium
Outbound traffic to Chinese networks cn_network_egress	Opens and immediately closes TCP connections to addresses in Chinese network ranges to establish whether geo-based egress filtering exists. No data is…	medium
Outbound SSH connection ssh_outbound_banner	Opens an SSH connection to a remote server and completes the protocol's identification exchange — reading the server's SSH-2.0 banner and sending our …	medium
Downloading the Tor Browser bundle tor_client_download	Fetches the official Tor Browser bundle from torproject.org to establish whether an anonymising client can be obtained on this network. The download i…	medium
Resolution of known-bad test domains malicious_dns_resolve	Resolves public malware/phishing test domains and looks for NXDOMAIN or sinkhole answers, which is how DNS filtering announces itself.	low

the whole catalogue this test in the list run it yourself

Catalogue generated from client 0.1.0. A test's behaviour can change between releases; this page describes the version named here.