Linux Perl Reverse Shell Pattern via perl -e with Socket::INET and connect/open/exec

Detects perl -e one-liners on Linux that include Perl Socket::INET reverse-shell code patterns and exec/connect logic.

FreeUnreviewedSigmahighv1

linux-perl-reverse-shell-pattern-via-perl-e-with-socket-inet-and-connect-open-ex-259df6bc

title: Linux Perl Reverse Shell Pattern via perl -e with Socket::INET and connect/open/exec
id: 08a8ea9f-1f74-4d7e-9c41-9420427704ce
status: test
description: This rule flags Linux process creation where the invoked binary is perl (path ending in /perl) with the -e flag and a command line containing reverse-shell-related constructs. It matches Perl code patterns using fdopen(), Socket::INET, and typical networking and execution calls such as connect, open, and exec. This behavior matters because attackers often use one-liner Perl scripts to establish outbound connections and execute commands through the same process. Detection relies on process creation telemetry with the full Image path and CommandLine content.
references:
  - https://pentestmonkey.net/cheat-sheet/shells/reverse-shell-cheat-sheet
  - https://www.revshells.com/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/linux/process_creation/proc_creation_lnx_perl_reverse_shell.yml
author: "@d4ns4n_, Nasreddine Bencherchali (Nextron Systems), Huntrule Team"
date: 2023-04-07
tags:
  - attack.execution
logsource:
  category: process_creation
  product: linux
detection:
  selection_img:
    Image|endswith: /perl
    CommandLine|contains: " -e "
  selection_content:
    - CommandLine|contains|all:
        - fdopen(
        - ::Socket::INET
    - CommandLine|contains|all:
        - Socket
        - connect
        - open
        - exec
  condition: all of selection_*
falsepositives:
  - Unlikely
level: high
license: DRL-1.1
related:
  - id: 259df6bc-003f-4306-9f54-4ff1a08fa38e
    type: derived

What it detects

This rule flags Linux process creation where the invoked binary is perl (path ending in /perl) with the -e flag and a command line containing reverse-shell-related constructs. It matches Perl code patterns using fdopen(), Socket::INET, and typical networking and execution calls such as connect, open, and exec. This behavior matters because attackers often use one-liner Perl scripts to establish outbound connections and execute commands through the same process. Detection relies on process creation telemetry with the full Image path and CommandLine content.

Known false positives

Unlikely

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.