Potential Perl Reverse Shell Execution

detection:
  selection_content:
    - CommandLine|contains|all:
        - 'fdopen('
        - '::Socket::INET'
    - CommandLine|contains|all:
        - 'Socket'
        - 'connect'
        - 'open'
        - 'exec'
  selection_img:
    CommandLine|contains: ' -e '
    Image|endswith: '/perl'
  condition: all of selection_*

The rule’s detection, its selections and fields in order of name. The whole rule, with its references and false positives, is on SigmaHQ, by @d4ns4n_, Nasreddine Bencherchali (Nextron Systems), under the Detection Rule License 1.1. CmdID evaluates it on a command line alone: a test on what a command line cannot show, such as the parent process or the user, is not met.

The commands LOLBAS or GTFOBins documents for perl trip it: each is on its program’s page, read by CmdID.