Windows Ruby Inline Code Execution via Ruby.exe -e Flag
Flags Windows executions of ruby.exe that include the inline code flag (-e) for direct command-line Ruby code.
- Product
- windows
- Category
- process_creation
- Author
- Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2023-01-02
- Updated
- 2026-07-30
ATT&CK techniques
ExecutionRecon
Resource Dev
Initial Access
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule identifies process creation where ruby.exe is executed with the inline code flag (-e) present in the command line. Attackers may use -e to run Ruby code directly from the command line, enabling quick execution without an existing script file. Detection relies on Windows process creation telemetry, matching ruby.exe execution and the presence of " -e" in the command line.
Reporting behind it
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Windows Ruby Inline Code Execution via Ruby.exe -e Flag
id: 150ea49e-70fc-4fd7-acc3-8446dc7641fe
status: test
description: This rule identifies process creation where ruby.exe is executed with the inline code flag (-e) present in the command line. Attackers may use -e to run Ruby code directly from the command line, enabling quick execution without an existing script file. Detection relies on Windows process creation telemetry, matching ruby.exe execution and the presence of " -e" in the command line.
references:
- https://pentestmonkey.net/cheat-sheet/shells/reverse-shell-cheat-sheet
- https://www.revshells.com/
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_ruby_inline_command_execution.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-01-02
tags:
- attack.execution
- attack.t1059
logsource:
category: process_creation
product: windows
detection:
selection_img:
- Image|endswith: \ruby.exe
- OriginalFileName: ruby.exe
selection_cli:
CommandLine|contains: " -e"
condition: all of selection_*
falsepositives:
- Unknown
level: medium
license: DRL-1.1
related:
- id: 20a5ffa1-3848-4584-b6f8-c7c7fd9f69c8
type: derived