Detectionhighexperimental

Python One-Liners with Base64 Decoding - Linux

Detects the use of Python's base64 decoding functions in command line executions on Linux systems. Malicious scripts often use python one-liners to decode and execute base64-encoded payloads, which is a common technique for obfuscation and evasion.

Convert In Phoenix Studio

Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.

Launch

Hugh Ryan (HueCodes), Swachchhanda Shrawan Poudel (Nextron Systems)Created Mon Mar 0955e862a8-dd9c-4651-807a-f21fcad56716linux

Log Source

LinuxProcess Creation

ProductLinux← raw: linux

CategoryProcess Creation← raw: process_creation

Events generated when a new process is spawned on the system. Covers command-line arguments, parent/child relationships, and process metadata.

Detection Logic

detection:
    selection_img:
        Image|contains: '/python'
    selection_cli:
        CommandLine|contains|all:
            - 'import'
            - 'base64'
            - ' -c'
        CommandLine|contains:
            - '.decode'
            - 'b16decode'
            - 'b32decode'
            - 'b32hexdecode'
            - 'b64decode'
            - 'b85decode'
            - 'z85decode'
    condition: all of selection_*

False Positives

Legitimate use of Python for decoding data, which is uncommon in typical enterprise environments but possible in development or data analysis contexts.

References

MITRE ATT&CK

Tactics

TA0002 · Execution TA0005 · Defense Evasion

Sub-techniques

T1059.006 · Python T1027.010 · Command Obfuscation

Related Rules

SimilarDetectionhigh

Python One-Liners with Base64 Decoding

Detects Python one-liners that use base64 decoding functions in command line executions. Malicious scripts or attackers often use python one-liners to decode and execute base64-encoded payloads, which is a common technique for obfuscation and evasion.

Detects similar activity. Both rules may fire on overlapping events.

Rule Metadata

Rule ID

55e862a8-dd9c-4651-807a-f21fcad56716

Status

experimental

Level

high

Type

Detection

Created

Mon Mar 09

Author

Hugh Ryan (HueCodes), Swachchhanda Shrawan Poudel (Nextron Systems)

Path

rules/linux/process_creation/proc_creation_lnx_python_base64_encoded_execution.yml

Raw Tags

attack.executionattack.t1059.006attack.defense-evasionattack.t1027.010

View on GitHub