JexBoss Command Sequence

Title: JexBoss Command Sequence
Status: test
Description:Detects suspicious command sequence that JexBoss
References:
  -https://www.us-cert.gov/ncas/analysis-reports/AR18-312A
Author: Florian Roth (Nextron Systems)
Date: 2017-08-24
modified:2025-11-22
Tags:

• -'attack.execution'
• -'attack.t1059.004'

Logsource:

• product: linux

Detection:
  keywords:
    |all:
      -'bash -c /bin/bash'
      -'&/dev/tcp/'

  condition:keywords
Falsepositives:
  -Unknown
Level: high