Skip to content
AI Security

Interview question · Detection Engineering & Incident Response

What are reverse shells and command-and-control channels, why do attackers use them, and how do you detect them?

Inbound is blocked, so the compromised host calls out. That single design choice tells defenders where to look: unusual parents spawning shells with network connections, and regular outbound traffic to places nobody else visits.

mediumEssentialNewPreparation tags: CrowdStrike, Palo Alto Networks, GoogleUpdated Nov 2026

Inbound is blocked, so the compromised host calls out. That single design choice tells defenders where to look: unusual parents spawning shells with network connections, and regular outbound traffic to places nobody else visits.

Make your first attempt

What would you say before reading the answer?

  1. 01 State the assumptions your answer depends on.
  2. 02 Explain the mechanism and choose a control.
  3. 03 Name a condition that would change your decision.

The worked answer includes an approach, scoring criteria and follow-up questions. Compare the reasoning with your own.

signing in unlocks more free answers per topic

What if · the follow-ups in this answer

The answer works through 6 follow-ups like an interviewer would

Your EDR shows a web server process spawning a shell that opens an outbound connection to an unknown IP address.

  1. What is a reverse shell, and why does it work?
  2. Why is a web server spawning a shell so suspicious?
  3. What do you do first?
  4. How do full C2 frameworks differ?
  5. What reduces the risk structurally?
  6. How would you respond and harden?

Each rung has a nudge, a model answer, the principle that carries over and the weak answer to avoid. Sign in free to open it.

UP NEXT ON YOUR JOURNEY
Next in this trackA cloud server's CPU is pegged and you find a cryptocurrency miner. Walk through your response.Next in this trackRansomware is spreading through your network. Walk through the first hours, the recovery, and the decisions leadership will face.Next in this trackWhat are the basics of digital forensics in an incident: order of volatility, evidence handling and what each artefact tells you?
DISCUSSION · 0

No comments yet. Share a correction or a different way to answer it.