Windows Ruby Inline Code Execution via Ruby.exe -e Flag

title: Windows Ruby Inline Code Execution via Ruby.exe -e Flag
id: 150ea49e-70fc-4fd7-acc3-8446dc7641fe
status: test
description: This rule identifies process creation where ruby.exe is executed with the inline code flag (-e) present in the command line. Attackers may use -e to run Ruby code directly from the command line, enabling quick execution without an existing script file. Detection relies on Windows process creation telemetry, matching ruby.exe execution and the presence of " -e" in the command line.
references:
  - https://pentestmonkey.net/cheat-sheet/shells/reverse-shell-cheat-sheet
  - https://www.revshells.com/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_ruby_inline_command_execution.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-01-02
tags:
  - attack.execution
  - attack.t1059
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    - Image|endswith: \ruby.exe
    - OriginalFileName: ruby.exe
  selection_cli:
    CommandLine|contains: " -e"
  condition: all of selection_*
falsepositives:
  - Unknown
level: medium
license: DRL-1.1
related:
  - id: 20a5ffa1-3848-4584-b6f8-c7c7fd9f69c8
    type: derived