netcat
Forward stdin/stdout to a file or network connection. toybox
On Linux 6 Sigma rules name it
Linux
Forward stdin/stdout to a file or network connection. When listening the COMMAND line is executed as a child process to handle an incoming connection. With no COMMAND -l forwards the connection to stdin/stdout. If no -p specified, -l prints the port it bound to and backgrounds itself (returning immediately). For a quick-and-dirty server, try something like: netcat -s 127.0.0.1 -p 1234 -L sh -l Or use "stty 115200 -F /dev/ttyS0 && stty raw -echo -ctlecho" with netcat -f to connect to a serial port.
netcat [-46ELlntUu] [-pqWw #] [-s addr] [-o FILE] {IPADDR PORTNUM|-f FILENAME|COMMAND...}
Show 18 options
-4Force IPv4-6Force IPv6-EForward stderr-fUse FILENAME (ala /dev/ttyS0) instead of network-LListen and background each incoming connection (server mode)-lListen for one incoming connection, then exit-nNo DNS lookup-o FILEHex dump to FILE (show packets, -o- writes hex only to stdout)-OHex dump to FILE (streaming mode)-pLocal port number-qQuit SECONDS after EOF on stdin, even if stdout hasn't closed yet-sLocal source address-tAllocate tty-uUse UDP-UUse a UNIX domain socket-WSECONDS timeout for more data on an idle connection-wSECONDS timeout to establish connection-zzero-I/O mode [used for scanning]Several platforms
This command is an alias of nc.
What detects it
highLinux Suspicious Child Process from Node.js - React2ShellSwachchhanda Shrawan Poudel (Nextron Systems), Nasreddine Bencherchali
mediumSuspicious Child Process of SAP NetWeaver - LinuxElastic (idea), Swachchhanda Shrawan Poudel (Nextron Systems)
lowLinux Network Service Scanning Tools ExecutionAlejandro Ortuno, oscd.community, Georg Lauenstein (sure[secure])