Potential Ruby Reverse Shell

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•0•1

Detects execution of ruby with the "-e" flag and calls to "socket" related functions. This could be an indication of a potential attempt to setup a reverse shell