Sigma Watch is free and independent. If it saves you time, keep it running. ☕ Buy me a coffee
SigmaWatch
ATT&CK technique

T1095

Non-Application Layer Protocol

Command and Control 39 detections found
View on MITRE ATT&CK →

Detection rules

Source Rule Status Updated
elastic Suspicious React Server Child Process production 2026-10-09
elastic Potential Reverse Shell Activity via Terminal production 2026-10-05
splunk Detect Large ICMP Traffic deprecated 2026-10-02
elastic Newly Observed IPSEC NAT Traversal Peer production 2026-09-22
elastic Suspicious Interpreter Execution Detected via Defend for Containers production 2026-09-18
elastic Azure AKS Pod Exec Potential Reverse Shell production 2026-09-18
elastic Netcat File Transfer or Listener Detected via Defend for Containers production 2026-09-18
elastic Web Server Exploitation Detected via Defend for Containers production 2026-09-18
elastic GKE Pod Exec Potential Reverse Shell production 2026-09-18
elastic Network Activity Detected via cat production 2026-09-18
elastic File Transfer or Listener Established via Netcat production 2026-09-18
elastic Netcat Listener Established via rlwrap production 2026-09-18
elastic Network Connection via Recently Compiled Executable production 2026-09-18
elastic Potential Reverse Shell via Background Process production 2026-09-18
elastic Potential Reverse Shell via Child production 2026-09-18
elastic Potential Reverse Shell via Suspicious Child Process production 2026-09-18
elastic Potential Reverse Shell via Suspicious Binary production 2026-09-18
elastic Potential Reverse Shell production 2026-09-18
elastic Potential Reverse Shell via UDP production 2026-09-18
elastic Network Connection Initiated by Suspicious SSHD Child Process production 2026-09-18
elastic Potential ICMP Tunneling Activity to the Internet production 2026-09-18
elastic Potential Command Shell via NetCat production 2026-09-18
splunk Linux Proxy Socks Curl production 2026-06-04
snort ET TROJAN ZeroTrace CnC Server Settings Inbound rev 1 2026-01-16
suricata ET MALWARE ZeroTrace CnC Server Settings Inbound rev 1 2026-01-16
snort ET TROJAN SillyRAT CnC Victim Keylogger Exfil rev 1 2025-07-16
suricata ET MALWARE SillyRAT CnC Victim Keylogger Exfil rev 1 2025-07-16
snort ET TROJAN SillyRAT CnC Server PING Inbound rev 1 2025-07-16
suricata ET MALWARE SillyRAT CnC Server PING Inbound rev 1 2025-07-16
suricata ET MALWARE GorillaBot Victim BotID Sent to CnC Server rev 1 2025-06-11
suricata ET MALWARE GorillaBot CnC Server Probe rev 1 2025-06-11
snort ET TROJAN GorillaBot CnC Server Probe rev 1 2025-06-11
snort ET TROJAN GorillaBot Victim BotID Sent to CnC Server rev 1 2025-06-11
suricata ET MALWARE VenomRAT CnC Server Keepalive rev 1 2024-09-05
snort ET TROJAN VenomRAT CnC Server Keepalive rev 1 2024-09-05
sigma Netcat The Powershell Version test 2023-10-27
elastic Suspicious Network Connection Attempt by Root deprecated 2023-07-31
sigma PUA - Netcat Suspicious Execution test 2023-02-08
sigma Suspicious DNS Z Flag Bit Set test 2022-11-29