{"id":"55e862a8-dd9c-4651-807a-f21fcad56716","title":"Python One-Liners with Base64 Decoding - Linux","description":"Detects the use of Python's base64 decoding functions in command line executions on Linux systems.\nMalicious scripts often use python one-liners to decode and execute base64-encoded payloads, which is a common technique for obfuscation and evasion.\n","author":"Hugh Ryan (HueCodes), Swachchhanda Shrawan Poudel (Nextron Systems)","status":"experimental","level":"high","date":"2026-03-09","modified":"","tags":["attack.execution","attack.stealth","attack.t1059.006","attack.t1027.010"],"technique_ids":["T1027.010","T1059.006"],"logsource":{"category":"process_creation","product":"linux"},"falsepositives":["Legitimate use of Python for decoding data, which is uncommon in typical enterprise environments but possible in development or data analysis contexts."],"references":["https://docs.python.org/3/library/base64.html","https://www.virustotal.com/gui/file/bc43e925d7b4b74319f6e74e836a96f1997ba404e14ac566cf12a21e9da463db/behavior","https://cloud.google.com/blog/topics/threat-intelligence/cybercriminals-weaponize-fake-ai-websites"],"source_path":"rules/linux/process_creation/proc_creation_lnx_python_base64_encoded_execution.yml","source_sha256":"4ea767c3ad37790390b5832da7cca1174a0ae09e1065a41c9fb21ca63bb48480","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/linux/process_creation/proc_creation_lnx_python_base64_encoded_execution.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Python One-Liners with Base64 Decoding - Linux\nid: 55e862a8-dd9c-4651-807a-f21fcad56716\nrelated:\n    - id: 50a0aa3d-ab16-4594-a8aa-5145a6e6792b\n      type: similar\nstatus: experimental\ndescription: |\n    Detects the use of Python's base64 decoding functions in command line executions on Linux systems.\n    Malicious scripts often use python one-liners to decode and execute base64-encoded payloads, which is a common technique for obfuscation and evasion.\nreferences:\n    - https://docs.python.org/3/library/base64.html\n    - https://www.virustotal.com/gui/file/bc43e925d7b4b74319f6e74e836a96f1997ba404e14ac566cf12a21e9da463db/behavior\n    - https://cloud.google.com/blog/topics/threat-intelligence/cybercriminals-weaponize-fake-ai-websites\nauthor: Hugh Ryan (HueCodes), Swachchhanda Shrawan Poudel (Nextron Systems)\ndate: 2026-03-09\ntags:\n    - attack.execution\n    - attack.stealth\n    - attack.t1059.006\n    - attack.t1027.010\nlogsource:\n    category: process_creation\n    product: linux\ndetection:\n    selection_img:\n        Image|contains: '/python'\n    selection_cli:\n        CommandLine|contains|all:\n            - 'import'\n            - 'base64'\n            - ' -c'\n        CommandLine|contains:\n            - '.decode'\n            - 'b16decode'\n            - 'b32decode'\n            - 'b32hexdecode'\n            - 'b64decode'\n            - 'b85decode'\n            - 'z85decode'\n    condition: all of selection_*\nfalsepositives:\n    - Legitimate use of Python for decoding data, which is uncommon in typical enterprise environments but possible in development or data analysis contexts.\nlevel: high\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1027.010","id":"T1027.010","name":"Command Obfuscation","page":"techniques/enterprise/T1027.010/"},{"key":"enterprise/T1059.006","id":"T1059.006","name":"Python","page":"techniques/enterprise/T1059.006/"}],"data_path":"data/detection-rules/55e862a8-dd9c-4651-807a-f21fcad56716.json","kind":"sigma"}