Windows Process Creation: Perl Inline Code Execution via -e/-E

title: "Windows Process Creation: Perl Inline Code Execution via -e/-E"
id: 26a9d53c-9bcb-467f-8f73-018fb7105f61
status: test
description: Identifies Windows processes where perl is executed (perl.exe) with command-line arguments containing inline execution flags (-e/-E). Attackers can use these flags to run arbitrary Perl code directly from the command line, often to stage or launch malicious functionality. The rule relies on process creation telemetry, matching executable name/path ending in \perl.exe and inspecting the process command line for ' -e'.
references:
  - https://pentestmonkey.net/cheat-sheet/shells/reverse-shell-cheat-sheet
  - https://www.revshells.com/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_perl_inline_command_execution.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-01-02
tags:
  - attack.execution
  - attack.t1059
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    - Image|endswith: \perl.exe
    - OriginalFileName: perl.exe
  selection_cli:
    CommandLine|contains: " -e"
  condition: all of selection_*
falsepositives:
  - Unknown
level: medium
license: DRL-1.1
related:
  - id: f426547a-e0f7-441a-b63e-854ac5bdf54d
    type: derived