Project 82: Reverse Shell Detection

Module: Module 9: Post-Exploitation Detection & Active Directory Security  |  Level: Advanced  | 
Primary tool: netstat + Sysmon (free, Microsoft Sysinternals)  |  Estimated time: 2–4 hours

Objective: Recognize the process-and-connection fingerprint of a reverse shell.

Free lab environment

LetsDefend (free tier) + CyberDefenders (free challenges) — https://letsdefend.io/ and https://cyberdefenders.org/blueteam-ctf-challenges/

Both platforms offer free-tier SOC-analyst simulations with real (sanitized) logs, alerts, and packet captures, so you can practice detection and triage without needing your own production environment.

Lab workflow

1. Access the free lab scenario (a clean VM with Sysmon installed, and Metasploitable2/Kali for the authorized lab-only trigger) and read the provided context before looking at any alert.
2. Using netstat + Sysmon (free, Microsoft Sysinternals), review the available logs/alerts with the specific goal of learning to recognize the process-and-connection fingerprint of a reverse shell.
3. For each candidate indicator, write down why it is suspicious in plain English before deciding it’s a true positive — this discipline avoids alert-fatigue-driven guessing.
4. Draft the detection rule or logic (in plain English or pseudocode) that would have caught this automatically in the future.
5. Cross-check your conclusion against the platform’s model answer or scoring, if provided, and note any gap between your reasoning and the expected answer.
6. Write up your finding as a short incident note: what happened, how you knew, what you’d do next.

Evidence & screenshot requirements

Submit the following with your report (see this module’s practical assignment for exact upload details):

• Sysmon Event ID 3 (network connection) log entry showing the suspicious outbound connection
• your written detection rule idea (e.g. a Sigma-style condition) that would flag it

Expected deliverable

A concise lab-report entry containing: scope/target, exact commands or payloads used, your key
observation, the required screenshots above, and — where applicable — the specific remediation for what
you found. Vague answers (“sanitize input”, “use a firewall”) without naming the exact mechanism will not
receive full credit.

Safety & authorization

Only test the specific free lab target named above, or infrastructure you personally own. Do not target
third-party systems, real user accounts, or production services without explicit written authorization.
Never deploy anything from this project outside an isolated lab environment.