Linux Perl Reverse Shell Execution via Perl -e and Socket/exec Patterns
Detects perl -e one-liners on Linux that include Perl Socket::INET reverse-shell code patterns and exec/connect logic.
- Product
- linux
- Category
- process_creation
- Author
- @d4ns4n_, Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2023-04-07
- Updated
- 2026-07-31
What it detects
This rule identifies process launches where the executable path ends with /perl and the command line includes the Perl -e execution flag. It further matches command-line content indicative of network socket usage and command execution, including patterns such as fdopen, Socket::INET, connect, open, and exec. These behaviors matter because they can be used to stage interactive remote command execution from a single Perl one-liner, relying on process creation telemetry with full command-line arguments.
Reporting behind it
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Linux Perl Reverse Shell Execution via Perl -e and Socket/exec Patterns
id: 08a8ea9f-1f74-4d7e-9c41-9420427704ce
status: test
description: This rule identifies process launches where the executable path ends with /perl and the command line includes the Perl -e execution flag. It further matches command-line content indicative of network socket usage and command execution, including patterns such as fdopen, Socket::INET, connect, open, and exec. These behaviors matter because they can be used to stage interactive remote command execution from a single Perl one-liner, relying on process creation telemetry with full command-line arguments.
references:
- https://pentestmonkey.net/cheat-sheet/shells/reverse-shell-cheat-sheet
- https://www.revshells.com/
- https://github.com/SigmaHQ/sigma/blob/master/rules/linux/process_creation/proc_creation_lnx_perl_reverse_shell.yml
author: "@d4ns4n_, Nasreddine Bencherchali (Nextron Systems), Huntrule Team"
date: 2023-04-07
tags:
- attack.execution
logsource:
category: process_creation
product: linux
detection:
selection_img:
Image|endswith: /perl
CommandLine|contains: " -e "
selection_content:
- CommandLine|contains|all:
- fdopen(
- ::Socket::INET
- CommandLine|contains|all:
- Socket
- connect
- open
- exec
condition: all of selection_*
falsepositives:
- Unlikely
level: high
license: DRL-1.1
related:
- id: 259df6bc-003f-4306-9f54-4ff1a08fa38e
type: derived