CmdID

CmdID / Commands

netcat

Forward stdin/stdout to a file or network connection. toybox

On Linux 6 Sigma rules name it

Opens CmdID with your command. It is read in your browser and sent nowhere.

Linux

from the toybox, 0BSD

Forward stdin/stdout to a file or network connection. When listening the COMMAND line is executed as a child process to handle an incoming connection. With no COMMAND -l forwards the connection to stdin/stdout. If no -p specified, -l prints the port it bound to and backgrounds itself (returning immediately). For a quick-and-dirty server, try something like: netcat -s 127.0.0.1 -p 1234 -L sh -l Or use "stty 115200 -F /dev/ttyS0 && stty raw -echo -ctlecho" with netcat -f to connect to a serial port.

netcat [-46ELlntUu] [-pqWw #] [-s addr] [-o FILE] {IPADDR PORTNUM|-f FILENAME|COMMAND...}
Show 18 options
-4Force IPv4
-6Force IPv6
-EForward stderr
-fUse FILENAME (ala /dev/ttyS0) instead of network
-LListen and background each incoming connection (server mode)
-lListen for one incoming connection, then exit
-nNo DNS lookup
-o FILEHex dump to FILE (show packets, -o- writes hex only to stdout)
-OHex dump to FILE (streaming mode)
-pLocal port number
-qQuit SECONDS after EOF on stdin, even if stdout hasn't closed yet
-sLocal source address
-tAllocate tty
-uUse UDP
-UUse a UNIX domain socket
-WSECONDS timeout for more data on an idle connection
-wSECONDS timeout to establish connection
-zzero-I/O mode [used for scanning]

Several platforms

from tldr-pages, CC BY 4.0

This command is an alias of nc.

What detects it

Sigma process creation rules that name netcat
highLinux Suspicious Child Process from Node.js - React2ShellSwachchhanda Shrawan Poudel (Nextron Systems), Nasreddine Bencherchali
highPotential Netcat Reverse Shell Execution@d4ns4n_, Nasreddine Bencherchali (Nextron Systems)
mediumInteractive Bash Suspicious ChildrenFlorian Roth (Nextron Systems)
mediumSuspicious Child Process of SAP NetWeaver - LinuxElastic (idea), Swachchhanda Shrawan Poudel (Nextron Systems)
lowLinux Network Service Scanning Tools ExecutionAlejandro Ortuno, oscd.community, Georg Lauenstein (sure[secure])
lowMacOS Network Service ScanningAlejandro Ortuno, oscd.community