Detectionlowtest

Decode Base64 Encoded Text

Detects usage of base64 utility to decode arbitrary base64-encoded text

Convert In Phoenix Studio

Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.

Daniil Yugoslavskiy, oscd.communityCreated Mon Oct 19Updated Sat Nov 27e2072cab-8c9a-459b-b63c-40ae79e27031linux

Log Source

LinuxProcess Creation

ProductLinux← raw: linux

CategoryProcess Creation← raw: process_creation

Events generated when a new process is spawned on the system. Covers command-line arguments, parent/child relationships, and process metadata.

Detection Logic

detection:
    selection:
        Image|endswith: '/base64'
        CommandLine|contains: '-d' # Also covers "--decode"
    condition: selection

False Positives

Legitimate activities

References

MITRE ATT&CK

Tactics

Techniques

Rule Metadata

Rule ID

e2072cab-8c9a-459b-b63c-40ae79e27031

Status

test

Level

low

Type

Detection

Created

Mon Oct 19

Modified

Sat Nov 27

Author

Path

rules/linux/process_creation/proc_creation_lnx_base64_decode.yml

Raw Tags

attack.defense-evasionattack.t1027