AML.T0072

MITRE ATLAS / Reverse Shell

Adversaries use a reverse shell to communicate with and control a victim system, having the compromised host initiate the connection outward so inbound firewall rules do not apply.

Think of it likeGetting the person inside the locked building to call you, because the phone only takes outgoing calls.

In plain English

Firewalls usually block connections coming in, not going out. A reverse shell has the compromised machine dial the attacker, and the channel looks like ordinary outbound traffic.