This anomaly detects exploitation of the Linux shell’s /dev/tcp and /dev/udp pseudo-device features to establish outbound network connections, commonly used to implement reverse shells without external tools. It targets shells such as bash, dash, sh, and zsh, and triggers when a process running one of these shells accesses a path matching */dev/tcp/* or */dev/udp/*, indicating redirection of shell I/O to a remote host/port. The detection relies on endpoint telemetry (process data) ingested via EDR agents and screens for contextual metadata including the process name, process ID, user, destination, parent process, and command line to surface suspected reverse-shell activity. In Splunk, the rule leverages the Endpoint data model (Processes) with CIM-normalized fields, aggregating by relevant process and metadata for triage. It maps to MITRE ATT&CK techniques T1059 (Command and Scripting Interpreter) and T1048.003, reflecting command-line/shell activity combined with potential remote control behaviors. The rule is intended for Linux endpoints and is designed to integrate with Splunk Enterprise/Splunk Cloud environments to support analytic stories and drill-down investigations. Known false positives can arise from legitimate admin or diagnostic use of these interfaces; mitigation includes filtering by authorized users, trusted hosts, and corroborating network indicators. References include a shell-reverse cheat sheet for context, and the rule supports drill-downs and risk storytelling within the Splunk platform.