Opening a reverse shell to a remote host

Blocks a command that hands an interactive shell to another machine: a bash/zsh/ksh redirection to /dev/tcp/ or /dev/udp/, nc/ncat with -e pointed at a shell, ncat --exec or --sh-exec, socat with an EXEC: or SYSTEM: address, and a python -c one-liner that imports socket together with subprocess, pty.spawn or os.dup2. This is the one rule in the pack that denies rather than asks: none of these has an ordinary use in coding work. Note that plain sh/dash lack /dev/tcp, which is a bash/zsh/ksh feature. Deliberately NOT matched: nc -zv host port (a port check), nc -l (a listener), socat -V, and a python -c that imports socket alone. MISSES a mkfifo back-pipe shell, whose halves are split across ;/| separators, a reverse shell written in Perl, Ruby, PHP or PowerShell's .NET sockets, and nc -e on the OpenBSD build, where -e means a TLS certificate name rather than a command. A quoted MENTION is not a use: a search, a git commit -m message, an echo or a curl --data body that only names this command is left alone. That holds only while every shell metacharacter stays inside the quotes, so git commit -m "x" && … is still caught; and the carrier must be the first word, so sudo grep … is not exempt.