This detection flags outbound network connections originating from Netcat or Netcat-like binaries on Linux hosts. Netcat is a versatile tool that, while legitimate for troubleshooting, is frequently abused by adversaries to create reverse shells, exfiltrate data, or establish covert command-and-control channels. The analytic searches the Network_Traffic data model for outbound connections where the app/process appears as a Netcat variant (nc, ncat, netcat) and groups results by source, destination, destination port, transport, and related process context. By tying the network flow to the originating process (process_name, app, user, process_id), defenders can more quickly identify compromised hosts and the actor’s workflow. The rule relies on data from EDR telemetry ingested and mapped into the Network_Traffic model, with Sysmon for Linux EventID 3 serving as a primary data source to capture process and network events in conjunction with CIM-normalized fields. If confirmed malicious, the activity could indicate C2 communication, data exfiltration, or persistent remote access, enabling attacker footholds across the environment. False positives may arise from legitimate administrators or developers using netcat for testing; filtering by known administrative activity or authorized users is advised. The detection is associated with MITRE ATT&CK technique T1059.004 (Unix Shell) given its use of shell-based tooling to perform network operations and potential post-exploitation actions. The rule supports downstream investigations through intermediate findings highlighting destination IPs, and threat objects identifying destination addresses, and is contextualized within analytic stories around Linux post-exploitation, C2, data exfiltration, and compromised Linux hosts.