BindShellPrompt

NOVA detection rule by benything · MIT

Detects attempts to describe or define a Python function that connects back to a remote host using sockets, indicative of reverse shell or backconnect behavior.

rule BindShellPrompt
{
    meta:
        description = "Detects attempts to describe or define a Python function that connects back to a remote host using sockets, indicative of reverse shell or backconnect behavior."
        author = "benything"
        version = "1.0.0"
        category = "abusing_functions/malware_generation"
        severity = "high"
        uuid = "075ae0fa-12d5-44d5-b27b-6db93708f67b"
        date = "2025-11-05"
        promptintel_url = "https://promptintel.novahunting.ai/prompt/075ae0fa-12d5-44d5-b27b-6db93708f67b"

    keywords:
        $socket_ref = "socket"
        $connect_func = "connect_back"
        $tcp_ref = "TCP"
        $host_ip = "host_ip"
        $host_port = "host_port"

    semantics:
        $reverse_connection = "create a function to connect back to a remote host or attacker" (0.2)
        $exfil_behavior = "reverse shell or remote access function definition" (0.2)

    llm:
        $analyze_reverse_connection = "Analyze if this text is describing or requesting code that connects back to a remote system or host, similar to a reverse shell or backconnect." (0.2)

    condition:
        (keywords.$socket_ref and (keywords.$connect_func or keywords.$tcp_ref)) and
        (semantics.$reverse_connection or semantics.$exfil_behavior or llm.$analyze_reverse_connection)
}

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

4d8c3719-014e-417f-bc14-cb3937bc6325

Propose edits, view related rules, and engage with the community through comments.

Executable code, not a declarative rule

This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.

Rejected pattern present

[[ reason ]]

What does this mean?

Format & documentation suggestions

Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.

[[ reason ]]

What do these messages mean?

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion