Skip to content

Hide Navigation Hide TOC

Python One-Liners with Base64 Decoding - Linux (55e862a8-dd9c-4651-807a-f21fcad56716)

Detects the use of Python's base64 decoding functions in command line executions on Linux systems. Malicious scripts often use python one-liners to decode and execute base64-encoded payloads, which is a common technique for obfuscation and evasion.

Cluster A Galaxy A Cluster B Galaxy B Level
Python - T1059.006 (cc3502b5-30cc-4473-ad48-42d51a6ef6d1) Attack Pattern Python One-Liners with Base64 Decoding - Linux (55e862a8-dd9c-4651-807a-f21fcad56716) Sigma-Rules 1
Command Obfuscation - T1027.010 (d511a6f6-4a33-41d5-bc95-c343875d1377) Attack Pattern Python One-Liners with Base64 Decoding - Linux (55e862a8-dd9c-4651-807a-f21fcad56716) Sigma-Rules 1
Python - T1059.006 (cc3502b5-30cc-4473-ad48-42d51a6ef6d1) Attack Pattern Command and Scripting Interpreter - T1059 (7385dfaf-6886-4229-9ecd-6fd678040830) Attack Pattern 2
Command Obfuscation - T1027.010 (d511a6f6-4a33-41d5-bc95-c343875d1377) Attack Pattern Obfuscated Files or Information - T1027 (b3d682b6-98f2-4fb0-aa3b-b4df007ca70a) Attack Pattern 2