Configuring Reverse Shell Detection and Defense

Constraints

• Intrusion prevention does not support decryption detection and defense for TLS- and SSL-encrypted traffic.

Impacts on Services

If IPS basic protection is enabled, a range of possible threats and suspicious traffic will be blocked. To change the protection mode, you are advised to enable the Observe mode and check false alarms for a period of time and then switch to the Intercept mode.

Actions

• Observe: Detected reverse shell attacks are only recorded in attack event logs.
• Block session: If the firewall detects a reverse shell attack, it blocks the current session.
• Block IP: If CFW detects a reverse shell attack, it blocks the attack IP address for a period of time.
  

  After Block IP is configured, CFW continuously blocks IP addresses. If address translation or proxy is involved, evaluate the impact of blocking IP addresses with caution.

Enabling Reverse Shell Defense

1. Log in to the CFW console.
2. Click in the upper left corner of the management console and select a region or project.
3. (Optional) Switch to another firewall instance. Select a firewall from the drop-down list in the upper left corner of the page.
4. In the navigation pane, choose Attack Defense > Intrusion Prevention.
5. Ensure Basic Protection is enabled.
6. Click Advanced at the bottom of the page. In the Reverse Shell Defense area, click to enable it.
   • Action:
     • Observe: Detected reverse shell attacks are only recorded in attack event logs.
     • Block session: If the firewall detects a reverse shell attack, it blocks the current session.
     • Block IP: If CFW detects a reverse shell attack, it blocks the attack IP address for a period of time.
       

       After Block IP is configured, CFW continuously blocks IP addresses. If address translation or proxy is involved, evaluate the impact of blocking IP addresses with caution.

   • Duration: If Action is set to Block IP, you can set the blocking duration. The value range is 60s to 3,600s.
   • Mode:
     • Conservative: coarse-grained protection. If a single session is attacked for four times, observation or interception is triggered. It ensures that no false positives are reported.
     • Sensitive: fine-grained protection. If a single session is attacked for two times, observation or interception is triggered. It ensures that attacks can be detected and handled.

7. Click OK.

Follow-up Operations

For details about the protection overview, see Viewing Attack Defense Information on the Dashboard. For details about logs, see Attack Event Logs.

Related Operations

• Changing the defense action: Click Configure in the Reverse Shell Defense area. In the displayed dialog box, select an action and click OK.
• Modifying the threshold: Click Configure in the Reverse Shell Defense area. In the displayed dialog box, set the threshold and click OK.
• Disabling reverse shell defense: Click next to Reverse Shell Defense. In the displayed dialog box, click OK.