Detectionhighexperimental

Python One-Liners with Base64 Decoding

Detects Python one-liners that use base64 decoding functions in command line executions. Malicious scripts or attackers often use python one-liners to decode and execute base64-encoded payloads, which is a common technique for obfuscation and evasion.

Convert In Phoenix Studio

Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.

Launch

Hugh Ryan (HueCodes), Swachchhanda Shrawan Poudel (Nextron Systems)Created Mon Mar 0950a0aa3d-ab16-4594-a8aa-5145a6e6792bwindows

Log Source

WindowsProcess Creation

ProductWindows← raw: windows

CategoryProcess Creation← raw: process_creation

Events generated when a new process is spawned on the system. Covers command-line arguments, parent/child relationships, and process metadata.

Detection Logic

detection:
    selection_img:
        - Image|contains: '\python'
        - OriginalFileName|contains: 'python'
    selection_cli:
        CommandLine|contains|all:
            - 'import'
            - 'base64'
            - ' -c'
        CommandLine|contains:
            - '.decode'
            - 'b16decode'
            - 'b32decode'
            - 'b32hexdecode'
            - 'b64decode'
            - 'b85decode'
            - 'z85decode'
    condition: all of selection_*

False Positives

Legitimate use of Python for decoding data, which is uncommon in typical enterprise environments but possible in development or data analysis contexts.

References

Testing & Validation

Regression Tests

by Swachchhanda Shrawan Poudel (Nextron Systems)

Positive Detection Test1 matchevtx

Microsoft-Windows-Sysmon

EVTX JSON

MITRE ATT&CK

Tactics

TA0002 · Execution TA0005 · Defense Evasion

Sub-techniques

T1059.006 · Python T1027.010 · Command Obfuscation

Related Rules

SimilarDetectionhigh

Python One-Liners with Base64 Decoding - Linux

Detects the use of Python's base64 decoding functions in command line executions on Linux systems. Malicious scripts often use python one-liners to decode and execute base64-encoded payloads, which is a common technique for obfuscation and evasion.

Detects similar activity. Both rules may fire on overlapping events.

Rule Metadata

Rule ID

50a0aa3d-ab16-4594-a8aa-5145a6e6792b

Status

experimental

Level

high

Type

Detection

Created

Mon Mar 09

Author

Hugh Ryan (HueCodes), Swachchhanda Shrawan Poudel (Nextron Systems)

Path

rules/windows/process_creation/proc_creation_win_python_base64_encoded_execution.yml

Raw Tags

attack.executionattack.t1059.006attack.defense-evasionattack.t1027.010

View on GitHub