Linux Process Creation: Base64-Encoded Shebang in Command Line

Flags Linux command lines containing Base64-encoded shebang prefixes for common shells, indicating potential encoded script execution.

FreeUnreviewedSigmamediumv1

linux-process-creation-base64-encoded-shebang-in-command-line-fe2f9663

title: "Linux Process Creation: Base64-Encoded Shebang in Command Line"
id: 0b333d62-cf9e-4d5b-bcb4-1c5763db040b
status: test
description: This rule matches Linux process creation events where the command line contains Base64-encoded shebang prefixes for common shells (e.g., bash, dash, zsh, fish, sh). Attackers may use encoded shebang content to hide or stage malicious script execution until it is decoded or interpreted. The detection relies on process creation telemetry and specifically inspects the raw command-line string for the expected Base64 substrings.
references:
  - https://www.trendmicro.com/pl_pl/research/20/i/the-evolution-of-malicious-shell-scripts.html
  - https://github.com/carlospolop/PEASS-ng/tree/master/linPEAS
  - https://github.com/SigmaHQ/sigma/blob/master/rules/linux/process_creation/proc_creation_lnx_base64_shebang_cli.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-09-15
tags:
  - attack.stealth
  - attack.t1140
logsource:
  product: linux
  category: process_creation
detection:
  selection:
    CommandLine|contains:
      - IyEvYmluL2Jhc2
      - IyEvYmluL2Rhc2
      - IyEvYmluL3pza
      - IyEvYmluL2Zpc2
      - IyEvYmluL3No
  condition: selection
falsepositives:
  - Legitimate administration activities
level: medium
license: DRL-1.1
related:
  - id: fe2f9663-41cb-47e2-b954-8a228f3b9dff
    type: derived

What it detects

This rule matches Linux process creation events where the command line contains Base64-encoded shebang prefixes for common shells (e.g., bash, dash, zsh, fish, sh). Attackers may use encoded shebang content to hide or stage malicious script execution until it is decoded or interpreted. The detection relies on process creation telemetry and specifically inspects the raw command-line string for the expected Base64 substrings.

Known false positives

Legitimate administration activities

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.