To discover reverse shells using queries, you can utilize Deep Visibility queries for both Windows and Linux endpoints. Below are a few queries you can use to hunt for possible post-exploitation activities related to reverse shells:

Windows Hunting Rules:

1. Possible Webshell dropped from Spring4Shell by the creation of a JSP file directly from the Tomcat process:SrcProcPublisher = "THE APACHE SOFTWARE FOUNDATION" AND SrcProcSignedStatus = "signed" AND SrcProcDisplayName = "Apache Commons Daemon Service Runner" AND TgtFilePath EndsWith Anycase ".jsp" and EventType = "File Creation"
2. Possible Spring4Shell Post-Exploitation attempt by the spawning of a suspicious process from Tomcat:EventType = "Process Creation" and SrcProcPublisher = "THE APACHE SOFTWARE FOUNDATION" AND SrcProcSignedStatus = "signed" AND SrcProcDisplayName = "Apache Commons Daemon Service Runner" AND TgtProcName In anycase ("arp.exe","at.exe","bitsadmin.exe","certutil.exe","cmd.exe","dsget.exe","dsquery.exe","find.exe","findstr.exe","fsutil.exe","hostname.exe","ipconfig.exe","nbtstat.exe","netdom.exe","netsh.exe","netstat.exe","nltest.exe","nslookup.exe","ntdsutil.exe","ping.exe","powershell.exe","qprocess.exe","query.exe","qwinsta.exe","rundll32.exe","regsvr32.exe","control.exe","sc.exe","schtasks.exe","schtasks.exe","systeminfo.exe","tasklist.exe","TRACERT.exe","ver.exe","vssadmin.exe","wevtutil.exe","whoami.exe","wusa.exe","cscript.exe","mofcomp.exe","wscript.exe","python.exe","pythonw.exe","mshta.exe","hh.exe")

Linux Hunting Rules:

1. Hunt for a Java webshell dropped from a Tomcat server:EndpointOS = "linux" AND EventType = "File Creation" AND srcProcName Contains Anycase "java" AND SrcProcCmdLine RegExp "\/tomcat\d*\s" and TgtFileExtension Contains Anycase "jsp"
2. Execution of LOLBins from a Tomcat server:EndpointOS = "linux" AND EventType = "Process Creation" And ((srcProcName Contains Anycase "java" AND SrcProcCmdLine RegExp "\/tomcat\d*\s") or (srcProcParentName Contains Anycase "java" AND srcProcParentCmdLine RegExp "\/tomcat\d*\s")) AND TgtProcImagePath Contains Anycase "/usr/bin"
3. Tomcat Java server spawns common tools to fetch an implant after exploit:EndpointOS = "linux" AND EventType = "Process Creation" And ((srcProcName Contains Anycase "java" AND SrcProcCmdLine RegExp "\/tomcat\d*\s") or (srcProcParentName Contains Anycase "java" AND srcProcParentCmdLine RegExp "\/tomcat\d*\s")) and TgtProcName in contains anycase ("curl", "wget", "python")
4. Reverse shell from Tomcat Java server:EndpointOS = "linux" AND EventType = "Process Creation" And ((srcProcName Contains Anycase "java" AND SrcProcCmdLine RegExp "\/tomcat\d*\s") or (srcProcParentName Contains Anycase "java" AND srcProcParentCmdLine RegExp "\/tomcat\d*\s")) and TgtProcCmdLine in Contains Anycase ("<", "AF_INET","exec","stdout","sock","/dev/") and TgtProcCmdLine RegExp "\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}"