Help Center/ Cloud Firewall/ User Guide/ Attack Defense/ Configuring Intrusion Prevention/ Configuring Reverse Shell Detection and Defense
Updated on 2026-09-14 GMT+08:00
View PDF
Share

Configuring Reverse Shell Detection and Defense

Scenario

In enterprise network environments, traditional security measures often fall short in defending against increasingly sophisticated network attacks, particularly reverse shell attacks. CFW defends against reverse shell attacks. After this function is enabled, the service can block reverse shells.

This section describes how to configure reverse shell detection and defense.

Notes and Constraints

  • Intrusion prevention does not support decryption detection and defense for TLS- and SSL-encrypted traffic.

Impacts on Services

If IPS basic protection is enabled, a range of possible threats and suspicious traffic will be blocked. To change the protection mode, you are advised to enable the Observe mode and check false alarms for a period of time and then switch to the Intercept mode.

Actions

  • Observe: If the firewall detects a reverse shell attack, it only records the attack in Viewing Attack Event Logs.
  • Block session: If the firewall detects a reverse shell attack, it blocks the current session.
  • Block IP: If CFW detects a reverse shell attack, it blocks the attack IP address for a period of time.

    After Block IP is configured, CFW continuously blocks IP addresses. If address translation or proxy is involved, evaluate the impact of blocking IP addresses with caution.

Enabling Reverse Shell Defense

  1. Enable at least one type of traffic protection.

  2. Log in to the CFW console.
  3. Click in the upper left corner of the management console and select a region or project.
  4. (Optional) Switch to another firewall instance. If there are multiple firewall instances, you can select a desired instance from the drop-down list in the upper left corner of the page.
  5. In the navigation pane on the left, choose Protection Policies > Attack Defense > Intrusion Prevention.
  6. Ensure Basic Protection is enabled.
  7. In the Reverse Shell Defense area, click the toggle button. The configuration page will be displayed.
  8. On the Reverse Shell Defense page, configure the action and protection mode.

    Table 1 Reverse shell detection

    Parameter

    Description

    Action
    • Observe: If the firewall detects a reverse shell attack, it only records the attack in Viewing Attack Event Logs.
    • Block session: If the firewall detects a reverse shell attack, it blocks the current session.
    • Block IP: If CFW detects a reverse shell attack, it blocks the attack IP address for a period of time.
      NOTE:

      After Block IP is configured, CFW continuously blocks IP addresses. If address translation or proxy is involved, evaluate the impact of blocking IP addresses with caution.

    Duration

    If Action is set to Block IP, you can set the blocking duration. The value range is 60s to 3,600s.

    Mode
    • Conservative: coarse-grained protection. If a single session is attacked for four times, observation or interception is triggered. It ensures that no false positives are reported.
    • Sensitive: fine-grained protection. If a single session is attacked for two times, observation or interception is triggered. It ensures that attacks can be detected and handled.

  9. Click OK.

Follow-up Operations

For details about the protection overview, see Event Center. For details about logs, see Viewing Attack Event Logs.

Related Operations

  • Changing the defense action: Click Configure in the Reverse Shell Defense area. In the displayed dialog box, select an action and click OK.
  • Modifying the threshold: Click Configure in the Reverse Shell Defense area. In the displayed dialog box, set the threshold and click OK.
  • Disabling reverse shell defense: Click next to Reverse Shell Defense. In the displayed dialog box, click OK.
Parent Topic: Configuring Intrusion Prevention