1. A method for tracking a reverse command shell intrusion on a user device, the method comprising: detecting a process starting on the user device; preparing the process to monitor Application Programming Interface (API) calls between the process and an operating system of the user device; determining whether the process is associated with a reverse command shell intrusion based on information associated with the process and/or the API calls; and executing security policies against the process associated with the reverse command shell intrusion; wherein determining whether the process is associated with a reverse command shell intrusion based upon the information associated with the process and/or the API calls comprises: determining whether the process is a command shell process and analyzing a parent process of the command shell process and determining a possible existence of a reverse shell intrusion in response to determining that the process is a command shell process and that the parent process of the command shell process is a command shell process, a user login process, or a desktop process; or determining whether the process is a command shell process and analyzing a parent process of the command shell process, analyzing a connection of the parent process, and determining a possible existence of reverse shell intrusion in response to determining that the connection of the parent process has a connection to a network application located in a network that is remote; or determining that the process is a command shell process and analyzing a parent process of the command shell process, detecting a readFile( ) API call, determining that a file descriptor of the readFile( ) API call matches a handle to a stdin stream of the command shell process, identifying commands passed by the parent process to the command shell process in the stdin stream of the command shell process, and concluding whether the process is a reverse command shell intrusion based on the commands; or determining that the process is a command shell process and analyzing a parent process of the command shell process, detecting a readConsole( ) API call, determining based on the readConsole( ) API call that the parent process is reading from a stdin stream of the command shell process, identifying commands passed by the parent process to the command shell process in the stdin stream of the command shell process, and concluding whether the process is a reverse command shell intrusion based on the commands.