Linux: Base64-Encoded Shebang Patterns in Command Line

Flags Linux command lines containing Base64-encoded shebang prefixes for common shells, indicating potential encoded script execution.

FreeReviewedSigma · Medium · v3

Product: linux
Category: process_creation
Author: Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
Published: 2022-09-15
Updated: 2026-07-31

Analysis Detection

ATT&CK techniques

Defense Evasion

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
- T1140Deobfuscate/Decode Files or Information
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule flags Linux process creations where the command line contains Base64-encoded shebang fragments corresponding to common shells (bash, dash, zsh, fish, sh). Attackers often embed an encoded script header to evade simple inspection before decoding and execution. The detection relies on process_creation telemetry and substring matching within the CommandLine field for the specific encoded sequences.

Reporting behind it

Related detections9 linkedT1140 — drag to rearrange

Suspicious Shell Command Obfuscation via printf Escape Encoding on VMware ESXi (via process_creation)

Hidden PowerShell Archive Extraction via ExtractToDirectory

Malicious Shell Payload Piped from curl to zsh

CastleLoader ClickFix PowerShell Hex Decode and Re-Execution

Suspicious Cabinet Extraction of Masqueraded vstm Archive via extrac32

Suspicious tar Extraction of Staged Archive to Temp (via process_creation)

Malicious Multi Layer Base64 Decoded Payload Execution via Bash (via process_creation)

Malicious Certutil Decode of Encoded Web Shell to ASPX (via process_creation)

Obfuscated File Decoding via Certutil (via process_creation)

Linux: Base64-Encoded Shebang Patterns in Command Line

Pivot detection · T1140 · 9 related

Changelog

v3
Candidate ingested via manual entry.2026-07-31
v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

linux-process-creation-base64-encoded-shebang-in-command-line-fe2f9663

title: "Linux: Base64-Encoded Shebang Patterns in Command Line"
id: 0b333d62-cf9e-4d5b-bcb4-1c5763db040b
status: test
description: This rule flags Linux process creations where the command line contains Base64-encoded shebang fragments corresponding to common shells (bash, dash, zsh, fish, sh). Attackers often embed an encoded script header to evade simple inspection before decoding and execution. The detection relies on process_creation telemetry and substring matching within the CommandLine field for the specific encoded sequences.
references:
  - https://www.trendmicro.com/pl_pl/research/20/i/the-evolution-of-malicious-shell-scripts.html
  - https://github.com/carlospolop/PEASS-ng/tree/master/linPEAS
  - https://github.com/SigmaHQ/sigma/blob/master/rules/linux/process_creation/proc_creation_lnx_base64_shebang_cli.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-09-15
tags:
  - attack.stealth
  - attack.t1140
logsource:
  product: linux
  category: process_creation
detection:
  selection:
    CommandLine|contains:
      - IyEvYmluL2Jhc2
      - IyEvYmluL2Rhc2
      - IyEvYmluL3pza
      - IyEvYmluL2Zpc2
      - IyEvYmluL3No
  condition: selection
falsepositives:
  - Legitimate administration activities
level: medium
license: DRL-1.1
related:
  - id: fe2f9663-41cb-47e2-b954-8a228f3b9dff
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL