AI Agents Linked to RubyGems Supply-Chain Attack: Detection and Hardening Guide for Package Registry Abuse

---
title: Gem or Bundler Package Installation on Server-Class Systems
id: 3f8c1a2e-7b4d-4e9a-b2c6-9d1e5f0a7b3c
status: experimental
description: Detects gem or bundler package installation commands, which on production servers and non-build infrastructure may indicate installation of a malicious or typosquatted RubyGems package. Scope alerting to servers; expect noise on developer workstations.
references:
  - https://www.securityweek.com/openai-investigates-report-linking-ai-agents-to-rubygems-attack/
  - https://attack.mitre.org/techniques/T1195/002/
author: Security Arsenal
date: 2026/05/15
tags:
  - attack.initial_access
  - attack.t1195.002
logsource:
  category: process_creation
  product: linux
detection:
  selection_img:
    Image|endswith:
      - '/gem'
      - '/bundle'
      - '/bundler'
      - '/ruby'
  selection_cli:
    CommandLine|contains:
      - 'gem install '
      - 'bundle add '
      - 'bundle install'
      - 'gem update '
  condition: selection_img and selection_cli
falsepositives:
  - Legitimate deployment pipelines that install gems at deploy time (these should be migrated to frozen, pre-built artifacts and then excluded)
  - Developer workstations (scope rule to server assets)
level: medium
---
title: Bundler or Gem Source Reconfiguration to Untrusted Registry
id: 8a2e4f1c-5d6b-4a3e-9c7d-2e8f1a0b4d6e
status: experimental
description: Detects modification of bundler or gem sources/mirrors, a technique used in dependency-confusion and registry-redirection attacks to pull packages from attacker-controlled or unintended repositories.
references:
  - https://www.securityweek.com/openai-investigates-report-linking-ai-agents-to-rubygems-attack/
  - https://attack.mitre.org/techniques/T1195/002/
author: Security Arsenal
date: 2026/05/15
tags:
  - attack.initial_access
  - attack.t1195.002
  - attack.defense_evasion
logsource:
  category: process_creation
  product: linux
detection:
  selection_gem_sources:
    CommandLine|contains:
      - 'gem sources --add'
      - 'gem sources -a'
      - 'gem sources --remove'
  selection_bundle_config:
    CommandLine|contains:
      - 'bundle config set'
      - 'bundle config --global'
      - 'bundle config --local'
    CommandLine|contains:
      - 'source'
      - 'mirror'
      - 'gemfile'
  condition: selection_gem_sources or selection_bundle_config
falsepositives:
  - Legitimate onboarding of an internal gem proxy (Artifactory/Nexus) — a rare, change-managed event that should be allowlisted per host
level: high
---
title: Ruby or Gem Process Spawning Shell or Downloader During Install
id: c1d7e3a9-2f4b-4c8d-a1e6-7b9d0f2a5c8e
status: experimental
description: Detects Ruby, gem, or bundle processes spawning shells or download utilities. Malicious gems frequently execute code at install time via extconf.rb to fetch second-stage payloads; legitimate native extension builds spawn compilers (gcc/make), not curl or sh -c with URLs.
references:
  - https://www.securityweek.com/openai-investigates-report-linking-ai-agents-to-rubygems-attack/
  - https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2026/05/15
tags:
  - attack.execution
  - attack.t1059
  - attack.t1195.002
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentImage|endswith:
      - '/ruby'
      - '/gem'
      - '/bundle'
      - '/rake'
  selection_child:
    Image|endswith:
      - '/sh'
      - '/bash'
      - '/dash'
      - '/curl'
      - '/wget'
      - '/nc'
      - '/ncat'
      - '/python'
      - '/python3'
  filter_build_tools:
    Image|endswith:
      - '/make'
      - '/gcc'
      - '/cc'
      - '/g++'
  condition: selection_parent and selection_child and not filter_build_tools
falsepositives:
  - Some legitimate gems shell out during native extension configuration — triage against known-good gem lists before excluding
level: high

// Hunt: RubyGems install activity and unexpected registry connections (14 days)
let Lookback = 14d;
let InstallEvents = DeviceProcessEvents
| where Timestamp > ago(Lookback)
| where ProcessCommandLine has_any ("gem install", "bundle add", "bundle install", "gem sources --add", "bundle config set")
| project InstallTime=Timestamp, DeviceName, AccountName, InstallCmd=ProcessCommandLine, InitiatingProcess=InitiatingProcessFileName, DeviceId;
InstallEvents;
// Correlate: which of those devices later saw a shell/downloader spawned by ruby tooling
let SuspectDevices = InstallEvents | distinct DeviceId;
DeviceProcessEvents
| where Timestamp > ago(Lookback)
| where DeviceId in (SuspectDevices)
| where InitiatingProcessFileName in~ ("ruby", "ruby.exe", "gem", "bundle", "rake")
| where FileName in~ ("sh", "bash", "curl", "wget", "powershell.exe", "cmd.exe", "python", "python3")
| project Timestamp, DeviceName, AccountName, InitiatingProcessFileName, FileName, ProcessCommandLine, SHA256
| order by Timestamp desc;
// Network view: non-Ruby processes connecting to RubyGems (downloader behavior)
DeviceNetworkEvents
| where Timestamp > ago(Lookback)
| where RemoteUrl has_any ("rubygems.org", "rubygems.global.ssl.fastly.net")
| where InitiatingProcessFileName !in~ ("ruby", "ruby.exe", "gem", "bundle", "bundler", "rake")
| project Timestamp, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, RemoteUrl, RemoteIP
| order by Timestamp desc

-- Hunt: RubyGems install activity, recent gem installs, and source reconfiguration
SELECT * FROM foreach(row={
  SELECT Pid, Name, CommandLine, Exe, Username, CreateTime
  FROM pslist()
  WHERE CommandLine =~ 'gem install|bundle add|bundle install|gem sources|bundle config'
}, query={
  SELECT Pid, Name, CommandLine, Username, CreateTime
  FROM scope()
})

-- Recently modified gem specifications (installed gems) in the last 14 days
SELECT FullPath, Mtime, Size
FROM glob(globs=[
  '/usr/lib/ruby/gems/*/specifications/*.gemspec',
  '/var/lib/gems/*/specifications/*.gemspec',
  '/home/*/.gem/ruby/*/specifications/*.gemspec',
  '/home/*/.rbenv/versions/*/lib/ruby/gems/*/specifications/*.gemspec',
  '/opt/*/gems/specifications/*.gemspec'
])
WHERE Mtime > now() - 1209600
ORDER BY Mtime DESC

-- Bundler configs that may override gem sources (dependency confusion vector)
SELECT FullPath, Mtime
FROM glob(globs=[
  '/home/*/.bundle/config',
  '/root/.bundle/config',
  '/**/.bundle/config'
])

#!/usr/bin/env bash
# rubygems-supply-chain-audit.sh — Security Arsenal
# Audits a host for suspicious RubyGems activity: recent installs, lockfile drift, source overrides.
# Run as root for full coverage. Read-only; safe for production.

set -u
DAYS="${1:-14}"
REPORT="/tmp/rubygems-audit-$(date +%Y%m%d-%H%M%S).txt"

echo "=== RubyGems Supply-Chain Audit — $(date) — window: ${DAYS} days ===" | tee "$REPORT"

echo -e "\n[1] Gems installed in the last ${DAYS} days (specification mtimes):" | tee -a "$REPORT"
find /usr/lib/ruby/gems /var/lib/gems /opt -type d -name specifications 2>/dev/null | while read -r d; do
  find "$d" -name '*.gemspec' -mtime -"$DAYS" -printf '%T+ %p\n' 2>/dev/null
done
find /home /root -type d -path '*specifications*' 2>/dev/null | while read -r d; do
  find "$d" -name '*.gemspec' -mtime -"$DAYS" -printf '%T+ %p\n' 2>/dev/null
done | sort -r | tee -a "$REPORT"

echo -e "\n[2] Bundler source/mirror overrides (.bundle/config):" | tee -a "$REPORT"
find / -name config -path '*.bundle*' -not -path '/proc/*' 2>/dev/null | while read -r f; do
  echo "--- $f ---" | tee -a "$REPORT"
  grep -Ei 'source|mirror|gemfile|disable_shared_gems' "$f" 2>/dev/null | tee -a "$REPORT"
done

echo -e "\n[3] Global gem sources (should be https://rubygems.org or your internal proxy ONLY):" | tee -a "$REPORT"
gem sources --list 2>/dev/null | tee -a "$REPORT"

echo -e "\n[4] Lockfile drift check for deployed apps (edit APP_DIRS for your estate):" | tee -a "$REPORT"
APP_DIRS="/srv /opt /var/www"
for base in $APP_DIRS; do
  find "$base" -maxdepth 4 -name 'Gemfile.lock' 2>/dev/null | while read -r lock; do
    appdir=$(dirname "$lock")
    echo "--- $lock ---" | tee -a "$REPORT"
    grep -A2 '^GEM' "$lock" | grep 'remote:' | sort -u | tee -a "$REPORT"
    # Gems in the bundle path not present in the lockfile = drift / potential injection
    if [ -d "$appdir/vendor/bundle" ]; then
      installed=$(find "$appdir/vendor/bundle" -name '*.gemspec' -exec basename {} .gemspec \; 2>/dev/null | sed 's/-[0-9][0-9.]*.*$//' | sort -u)
      locked=$(grep -E '^    [a-zA-Z0-9_.-]+ \(' "$lock" | awk '{print $1}' | sort -u)
      comm -23 <(echo "$installed") <(echo "$locked") | while read -r extra; do
        echo "ALERT: installed but not in lockfile: $extra ($appdir)" | tee -a "$REPORT"
      done
    fi
  done
done

echo -e "\n[5] Known-bad hygiene: world-writable gem dirs, gems running as root services" | tee -a "$REPORT"
find /var/lib/gems /usr/lib/ruby/gems -maxdepth 3 -type d -perm -o+w 2>/dev/null | tee -a "$REPORT"

echo -e "\n=== Audit complete: $REPORT ==="
echo "Next steps: cross-reference section [1] and [4] ALERTs against your allowlist;"
echo "any unrecognized gem name -> isolate host, preserve /tmp + gem dirs for forensics."