Detection catalogue

Explore published rules with transparent provenance, licensing, and ATT&CK mappings.

detections

Loading detections…

Linux Ruby Privilege Escalation

The following analytic detects the execution of Ruby commands with elevated privileges on a Linux system. It identifies processes where Ruby is used with the `-e` flag to execute commands via `sudo`, leveraging Endpoint Detection and Response (EDR) telemetry. This activity is significant because it indicates a potential privilege escalation attempt, allowing a user to execute commands as root. If confirmed malicious, this could lead to full system compromise, enabling an attacker to gain root access, execute arbitrary commands, and maintain persistent control over the affected system.

ATT&CK coverage

Outside the enterprise matrix

T1548.003

Detection requirements

Log source category: sysmon_for_linux_eventid_1

What the source says

What fires this without an attack behind it

False positives are present based on automated tooling or system administrative usage. Filter as needed.

References

https://gtfobins.github.io/gtfobins/ruby/

Tagged by the source as

Linux Living Off The LandLinux Privilege EscalationEndpointendpointSplunk CloudSplunk EnterpriseSplunk Enterprise Securityendpoint

Detection logic

Published to signed-in readers

The query as its source wrote it, its canonical form, and the content hash that pins this exact revision.