{"id":"50a0aa3d-ab16-4594-a8aa-5145a6e6792b","title":"Python One-Liners with Base64 Decoding","description":"Detects Python one-liners that use base64 decoding functions in command line executions.\nMalicious scripts or attackers often use python one-liners to decode and execute base64-encoded payloads, which is a common technique for obfuscation and evasion.\n","author":"Hugh Ryan (HueCodes), Swachchhanda Shrawan Poudel (Nextron Systems)","status":"experimental","level":"high","date":"2026-03-09","modified":"","tags":["attack.execution","attack.stealth","attack.t1059.006","attack.t1027.010"],"technique_ids":["T1027.010","T1059.006"],"logsource":{"category":"process_creation","product":"windows"},"falsepositives":["Legitimate use of Python for decoding data, which is uncommon in typical enterprise environments but possible in development or data analysis contexts."],"references":["https://docs.python.org/3/library/base64.html","https://www.virustotal.com/gui/file/bc43e925d7b4b74319f6e74e836a96f1997ba404e14ac566cf12a21e9da463db/behavior","https://cloud.google.com/blog/topics/threat-intelligence/cybercriminals-weaponize-fake-ai-websites"],"source_path":"rules/windows/process_creation/proc_creation_win_python_base64_encoded_execution.yml","source_sha256":"ef5d4ce9fe75733ca8295828b0df78aab033fbbb1b70643de9af6ffc7e49dac3","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_python_base64_encoded_execution.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Python One-Liners with Base64 Decoding\nid: 50a0aa3d-ab16-4594-a8aa-5145a6e6792b\nrelated:\n    - id: 55e862a8-dd9c-4651-807a-f21fcad56716\n      type: similar\nstatus: experimental\ndescription: |\n    Detects Python one-liners that use base64 decoding functions in command line executions.\n    Malicious scripts or attackers often use python one-liners to decode and execute base64-encoded payloads, which is a common technique for obfuscation and evasion.\nreferences:\n    - https://docs.python.org/3/library/base64.html\n    - https://www.virustotal.com/gui/file/bc43e925d7b4b74319f6e74e836a96f1997ba404e14ac566cf12a21e9da463db/behavior\n    - https://cloud.google.com/blog/topics/threat-intelligence/cybercriminals-weaponize-fake-ai-websites\nauthor: Hugh Ryan (HueCodes), Swachchhanda Shrawan Poudel (Nextron Systems)\ndate: 2026-03-09\ntags:\n    - attack.execution\n    - attack.stealth\n    - attack.t1059.006\n    - attack.t1027.010\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection_img:\n        - Image|contains: '\\python'\n        - OriginalFileName|contains: 'python'\n    selection_cli:\n        CommandLine|contains|all:\n            - 'import'\n            - 'base64'\n            - ' -c'\n        CommandLine|contains:\n            - '.decode'\n            - 'b16decode'\n            - 'b32decode'\n            - 'b32hexdecode'\n            - 'b64decode'\n            - 'b85decode'\n            - 'z85decode'\n    condition: all of selection_*\nfalsepositives:\n    - Legitimate use of Python for decoding data, which is uncommon in typical enterprise environments but possible in development or data analysis contexts.\nlevel: high\nregression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_python_base64_encoded_execution/info.yml\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1027.010","id":"T1027.010","name":"Command Obfuscation","page":"techniques/enterprise/T1027.010/"},{"key":"enterprise/T1059.006","id":"T1059.006","name":"Python","page":"techniques/enterprise/T1059.006/"}],"data_path":"data/detection-rules/50a0aa3d-ab16-4594-a8aa-5145a6e6792b.json","kind":"sigma"}