huntrule

Linux Process Creation: Ruby -e Reverse Shell Socket Usage

Detects inline Ruby (-e) using rsocket/TCPSocket and shell keywords, which may indicate reverse-shell style behavior.

FreeReviewedSigma · Medium · v2
Product
linux
Category
process_creation
Author
@d4ns4n_ (SigmaHQ), DRL 1.1
Published
2023-04-07
Updated
2026-07-31
AnalysisDetection
title: "Linux Process Creation: Ruby -e Reverse Shell Socket Usage"
id: 32c50815-79f7-46cb-a83a-df48351c3b9c
status: test
description: This rule flags Linux process creation events where Ruby is executed with the "-e" flag and the command line includes socket-related identifiers such as "rsocket" and "TCPSocket". These strings are commonly associated with Ruby scripts that attempt to open network connections, a prerequisite for reverse-shell style behavior. It relies on process creation telemetry that records the Image name and full CommandLine.
references:
  - https://pentestmonkey.net/cheat-sheet/shells/reverse-shell-cheat-sheet
  - https://www.revshells.com/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/linux/process_creation/proc_creation_lnx_ruby_reverse_shell.yml
author: "@d4ns4n_, Huntrule Team"
date: 2023-04-07
tags:
  - attack.execution
logsource:
  category: process_creation
  product: linux
detection:
  selection:
    Image|contains: ruby
    CommandLine|contains|all:
      - " -e"
      - rsocket
      - TCPSocket
    CommandLine|contains:
      - " ash"
      - " bash"
      - " bsh"
      - " csh"
      - " ksh"
      - " pdksh"
      - " sh"
      - " tcsh"
  condition: selection
falsepositives:
  - Unknown
level: medium
license: DRL-1.1
related:
  - id: b8bdac18-c06e-4016-ac30-221553e74f59
    type: derived