Potential Ruby Reverse Shell

Status: test
Severity: medium
Log source: category process_creation, product linux
Author: @d4ns4n_
Source: github.com/SigmaHQ/sigma

Detects execution of ruby with the "-e" flag and calls to "socket" related functions. This could be an indication of a potential attempt to setup a reverse shell

MITRE ATT&CK coverage

Tactic	Techniques
Execution	No specific technique

Telemetry coverage

Platform	Record / event type
Linux	Event ID 1: Process Create

Rule body

title: Potential Ruby Reverse Shell
id: b8bdac18-c06e-4016-ac30-221553e74f59
status: test
description: Detects execution of ruby with the "-e" flag and calls to "socket" related functions. This could be an indication of a potential attempt to setup a reverse shell
references:
    - https://pentestmonkey.net/cheat-sheet/shells/reverse-shell-cheat-sheet
    - https://www.revshells.com/
author: '@d4ns4n_'
date: 2023-04-07
tags:
    - attack.execution
logsource:
    category: process_creation
    product: linux
detection:
    selection:
        Image|contains: 'ruby'
        CommandLine|contains|all:
            - ' -e'
            - 'rsocket'
            - 'TCPSocket'
        CommandLine|contains:
            - ' ash'
            - ' bash'
            - ' bsh'
            - ' csh'
            - ' ksh'
            - ' pdksh'
            - ' sh'
            - ' tcsh'
    condition: selection
falsepositives:
    - Unknown
level: medium

Stages and Predicates

Stage 0: `condition`

selection

Stage 1: `selection`

selection:
    Image|contains: 'ruby'
    CommandLine|contains|all:
        - ' -e'
        - 'rsocket'
        - 'TCPSocket'
    CommandLine|contains:
        - ' ash'
        - ' bash'
        - ' bsh'
        - ' csh'
        - ' ksh'
        - ' pdksh'
        - ' sh'
        - ' tcsh'

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`CommandLine`	match	`-e` `ash` `bash` `bsh` `csh` `ksh` `pdksh` `sh` `tcsh` `TCPSocket` `rsocket`	`field:"CommandLine" kind:match`
`Image`	match	`ruby`	`field:"Image" kind:match value:"ruby"`