ncat

Read, write, redirect, and encrypt data across a network. tldr-pages

On Linux 5 Sigma rules name it

Linux

Read, write, redirect, and encrypt data across a network. An alternative implementation of a similar utility called netcat/nc.

Listen for input on the specified port and write it to the specified file

ncat --listen port >path/to/fileIdentify

Accept multiple connections and keep ncat open after they have been closed

ncat --listen --keep-open portIdentify

Write output of specified file to the specified host on the specified port

ncat <path/to/file address portIdentify

Trips 1 Sigma rule: lowLinux Network Service Scanning Tools Execution by Alejandro Ortuno, oscd.community, Georg Lauenstein (sure[secure])

Accept multiple incoming connections on an encrypted channel evading detection of traffic content

ncat --ssl --keep-open --listen portIdentify

Connect to an open ncat connection over SSL

ncat --ssl host portIdentify

Trips 1 Sigma rule: lowLinux Network Service Scanning Tools Execution by Alejandro Ortuno, oscd.community, Georg Lauenstein (sure[secure])

Check connectivity to a remote host on a particular port with timeout

ncat --wait seconds --verbose -z host portIdentify

Trips 1 Sigma rule: lowLinux Network Service Scanning Tools Execution by Alejandro Ortuno, oscd.community, Georg Lauenstein (sure[secure])

Sigma process creation rules that name ncat

highLinux Suspicious Child Process from Node.js - React2ShellSwachchhanda Shrawan Poudel (Nextron Systems), Nasreddine Bencherchali

highPotential Netcat Reverse Shell Execution@d4ns4n_, Nasreddine Bencherchali (Nextron Systems)

mediumSuspicious Child Process of SAP NetWeaver - LinuxElastic (idea), Swachchhanda Shrawan Poudel (Nextron Systems)

lowLinux Network Service Scanning Tools ExecutionAlejandro Ortuno, oscd.community, Georg Lauenstein (sure[secure])