Ruby Inline Command Execution

Title: Ruby Inline Command Execution
Status: test
Description:Detects execution of ruby using the "-e" flag. This is could be used as a way to launch a reverse shell or execute live ruby code.
References:
  -https://pentestmonkey.net/cheat-sheet/shells/reverse-shell-cheat-sheet
  -https://www.revshells.com/
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2023-01-02
modified:None
Tags:

• -'attack.execution'
• -'attack.t1059'

Logsource:

• category: process_creation
• product: windows

Detection:
  selection_img:
Image|endswith:'\ruby.exe' OriginalFileName:'ruby.exe'   selection_cli:
    CommandLine|contains: ' -e'
  condition:all of selection_*
Falsepositives:
  -Unknown
Level: medium