Potential Xterm Reverse Shell

Title: Potential Xterm Reverse Shell
Status: test
Description:Detects usage of "xterm" as a potential reverse shell tunnel
References:
  -https://pentestmonkey.net/cheat-sheet/shells/reverse-shell-cheat-sheet
  -https://www.revshells.com/
Author: @d4ns4n_
Date: 2023-04-24
modified:None
Tags:

• -'attack.execution'
• -'attack.t1059'

Logsource:

• category: process_creation
• product: linux

Detection:
  selection:
    Image|contains: 'xterm'
    CommandLine|contains: '-display'
    CommandLine|endswith: ':1'
  condition:selection
Falsepositives:
  -Unknown
Level: medium