Windows Process Creation: Perl Inline Code Execution via -e/-E
Flags command-line usage of perl.exe with inline execution (-e) on Windows process creation events.
- Product
- windows
- Category
- process_creation
- Author
- Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2023-01-02
- Updated
- 2026-07-30
ATT&CK techniques
ExecutionRecon
Resource Dev
Initial Access
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
Identifies Windows processes where perl is executed (perl.exe) with command-line arguments containing inline execution flags (-e/-E). Attackers can use these flags to run arbitrary Perl code directly from the command line, often to stage or launch malicious functionality. The rule relies on process creation telemetry, matching executable name/path ending in \perl.exe and inspecting the process command line for ' -e'.
Reporting behind it
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Windows Process Creation: Perl Inline Code Execution via -e/-E"
id: 26a9d53c-9bcb-467f-8f73-018fb7105f61
status: test
description: Identifies Windows processes where perl is executed (perl.exe) with command-line arguments containing inline execution flags (-e/-E). Attackers can use these flags to run arbitrary Perl code directly from the command line, often to stage or launch malicious functionality. The rule relies on process creation telemetry, matching executable name/path ending in \perl.exe and inspecting the process command line for ' -e'.
references:
- https://pentestmonkey.net/cheat-sheet/shells/reverse-shell-cheat-sheet
- https://www.revshells.com/
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_perl_inline_command_execution.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-01-02
tags:
- attack.execution
- attack.t1059
logsource:
category: process_creation
product: windows
detection:
selection_img:
- Image|endswith: \perl.exe
- OriginalFileName: perl.exe
selection_cli:
CommandLine|contains: " -e"
condition: all of selection_*
falsepositives:
- Unknown
level: medium
license: DRL-1.1
related:
- id: f426547a-e0f7-441a-b63e-854ac5bdf54d
type: derived