Perl Inline Command Execution
This rule detects the execution of the Perl interpreter using the `-e` or `-E` flags. These flags allow for inline execution of Perl code directly from the command line, which can be leveraged by adversaries to launch reverse shells, execute arbitrary commands, or run malicious scripts without needing to write a Perl file to disk. This technique is often used in post-exploitation scenarios for stealthy command execution.
Sigma
