Ruby Inline Command Execution
This rule detects the execution of the Ruby interpreter (ruby.exe) with the "-e" flag. This flag allows for inline execution of Ruby code directly from the command line, which can be leveraged by adversaries to execute arbitrary commands, launch reverse shells, or run malicious Ruby scripts without needing to save them to a file. This technique is often used in post-exploitation scenarios or for initial access.
Sigma
