Linux Process Creation: Ruby -e Scripts Calling TCPSocket via rsocket

title: "Linux Process Creation: Ruby -e Scripts Calling TCPSocket via rsocket"
id: 32c50815-79f7-46cb-a83a-df48351c3b9c
status: test
description: This rule flags Linux process creation where the executable path/command line contains "ruby" and the command line includes Ruby inline execution (" -e") along with the string "rsocket" and a "TCPSocket" usage. It also matches additional shell invocation keywords (e.g., "sh", "bash", "ksh", "csh") in the command line. Such patterns can indicate an attacker attempting to establish network-based command execution. The detection relies on process creation telemetry including the image/command line content.
references:
  - https://pentestmonkey.net/cheat-sheet/shells/reverse-shell-cheat-sheet
  - https://www.revshells.com/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/linux/process_creation/proc_creation_lnx_ruby_reverse_shell.yml
author: "@d4ns4n_, Huntrule Team"
date: 2023-04-07
tags:
  - attack.execution
logsource:
  category: process_creation
  product: linux
detection:
  selection:
    Image|contains: ruby
    CommandLine|contains|all:
      - " -e"
      - rsocket
      - TCPSocket
    CommandLine|contains:
      - " ash"
      - " bash"
      - " bsh"
      - " csh"
      - " ksh"
      - " pdksh"
      - " sh"
      - " tcsh"
  condition: selection
falsepositives:
  - Unknown
level: medium
license: DRL-1.1
related:
  - id: b8bdac18-c06e-4016-ac30-221553e74f59
    type: derived