Sigma rule: Python One-Liners with Base64 Decoding - Linux

Rule

Title

Python One-Liners with Base64 Decoding - Linux

Status

experimental

Level

high

Author

Hugh Ryan (HueCodes), Swachchhanda Shrawan Poudel (Nextron Systems)

Date

2026-03-09

File

rules/linux/process_creation/proc_creation_lnx_python_base64_encoded_execution.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects the use of Python's base64 decoding functions in command line executions on Linux systems.
Malicious scripts often use python one-liners to decode and execute base64-encoded payloads, which is a common technique for obfuscation and evasion.

Log source

product

linux

category

process_creation

Detection

selection_img:
    Image|contains: '/python'
selection_cli:
    CommandLine|contains|all:
        - 'import'
        - 'base64'
        - ' -c'
    CommandLine|contains:
        - '.decode'
        - 'b16decode'
        - 'b32decode'
        - 'b32hexdecode'
        - 'b64decode'
        - 'b85decode'
        - 'z85decode'
condition: all of selection_*

False positives (as the rule lists them)

• Legitimate use of Python for decoding data, which is uncommon in typical enterprise environments but possible in development or data analysis contexts.

Tags

• attack.execution
• attack.stealth
• attack.t1059.006
• attack.t1027.010

MITRE ATT&CK ids this rule names

• T1027.010
• T1059.006

Related rules

• 50a0aa3d-ab16-4594-a8aa-5145a6e6792b (similar)

References

• https://docs.python.org/3/library/base64.html
• https://www.virustotal.com/gui/file/bc43e925d7b4b74319f6e74e836a96f1997ba404e14ac566cf12a21e9da463db/behavior
• https://cloud.google.com/blog/topics/threat-intelligence/cybercriminals-weaponize-fake-ai-websites

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/linux/process_creation/proc_creation_lnx_python_base64_encoded_execution.yml