Skip to content

Siemphony is in beta and still being built. How a rule earns its badge.

Siemphonybeta
Ramil Namazov’s repertoire

Shell interpreter opening an external network connection

Ramil Namazov@ramil-namazovhighT1059.004unverified
A shell interpreter that initiates an outbound connection to a non-private address has the shape of a reverse shell. The internal filter keeps routine administrative traffic out so the rule stays quiet on normal estate activity.Full description

The detection

The 2 SIEM queries below are previews produced by Siemphony’s own translator, not pySigma, and none has been executed against a real backend — review before you deploy.

detection.yml

Splunk · SPL

Run this as a search.

index=* (((Image="*/bash" OR Image="*/sh" OR Image="*/python3") AND Initiated="true") AND NOT ((DestinationIp="10.*" OR DestinationIp="192.168.*" OR DestinationIp="172.16.*")))

Wazuh · XML rule

Deploy to your manager — this is a rule, not a search.

<group name="sigma,linux,network_connection,">  <!-- Rule ids must be unique on your manager; 100000+ is the user range. -->  <rule id="100000" level="12">    <!-- Set <if_sid> to the decoder/base rule for linux so this only evaluates relevant events. -->    <field name="Image" type="pcre2">(?i)(/bash$|/sh$|/python3$)</field>    <field name="Initiated" type="pcre2">(?i)^true$</field>    <field name="DestinationIp" negate="yes" type="pcre2">(?i)(^10\.|^192\.168\.|^172\.16\.)</field>    <description>Shell interpreter opening an external network connection</description>    <mitre>      <id>T1059.004</id>    </mitre>  </rule></group>

Sentinel · KQL

Run this as a search.

Sentinel cannot express this construct. `Initiated` has no Sentinel column: Defender expresses connection direction in `ActionType`, not as a boolean column, so `Initiated` cannot be renamed — it needs a different predicate. The Sigma source is on the first tab, unchanged.

Elastic · ES|QL

Run this as a search.

Elastic cannot express this construct. `Initiated` has no ECS field: ECS expresses connection direction as `network.direction` with values like `egress`, not as a boolean, so `Initiated` needs a different predicate rather than a rename. The Sigma source is on the first tab, unchanged.

Verdicts · reactions · comments

Community

Verdicts from engineers who actually deployed it, and the conversation around it.

Log in to react
Not yet reported on

Nobody has run this in a real environment and said what happened.

Verdicts from engineers who deployed it

0 cast

No verdicts reported yet. The first one is worth more than the tenth — say what you ran it against.

Log in to report a verdict.

Log in to join the discussion.

3 threads

  • @priya-raman

    filter_internal covers `172.16.` only, but RFC 1918 runs from 172.16 to 172.31 — so 172.17 upward is treated as external. That is Docker's default bridge range, which means any container on the host talking outbound through a shell gives you a steady drip of false positives that look exactly like a reverse shell. A `172.` prefix would over-match public space, so the honest fix is the sixteen explicit second octets, or a CIDR match if the backend supports one.

    • @nadia-brandt

      Also `/python3` but not `/python`, `/perl`, `/ruby` or `/node`, and a reverse shell one-liner in any of those is a two-minute search away. I am not arguing for a longer list — every entry costs noise and the short one is defensible — but the gap deserves a line in the description, so nobody reads a quiet rule as a clean estate.

  • Deleted by its author.
  • Deleted by its author.
    • Deleted by its author.