Linux process executions of Python base64 decoding in one-liners

Alerts on Linux process creations running Python -c one-liners that import base64 and invoke decoding functions.

FreeUnreviewedSigmahighv1

linux-process-executions-of-python-base64-decoding-in-one-liners-55e862a8

title: Linux process executions of Python base64 decoding in one-liners
id: 9c054e2a-feac-45e8-abe9-ce4398cc8825
related:
  - id: 50a0aa3d-ab16-4594-a8aa-5145a6e6792b
    type: similar
  - id: 55e862a8-dd9c-4651-807a-f21fcad56716
    type: derived
status: experimental
description: This rule flags Linux command-line executions of Python one-liners that import the base64 module and use base64 decoding functions (e.g., .decode, b16decode/b32decode/b64decode variants) via python -c style invocation. Attackers commonly use this pattern to obfuscate payloads and reduce detection by hiding executable content inside encoded strings that get decoded at runtime. The detection relies on process creation telemetry, matching the image path for python and specific command-line substrings indicating base64 usage and inline execution.
references:
  - https://docs.python.org/3/library/base64.html
  - https://www.virustotal.com/gui/file/bc43e925d7b4b74319f6e74e836a96f1997ba404e14ac566cf12a21e9da463db/behavior
  - https://cloud.google.com/blog/topics/threat-intelligence/cybercriminals-weaponize-fake-ai-websites
  - https://github.com/SigmaHQ/sigma/blob/master/rules/linux/process_creation/proc_creation_lnx_python_base64_encoded_execution.yml
author: Hugh Ryan (HueCodes), Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule Team
date: 2026-03-09
tags:
  - attack.execution
  - attack.stealth
  - attack.t1059.006
  - attack.t1027.010
logsource:
  category: process_creation
  product: linux
detection:
  selection_img:
    Image|contains: /python
  selection_cli:
    CommandLine|contains|all:
      - import
      - base64
      - " -c"
    CommandLine|contains:
      - .decode
      - b16decode
      - b32decode
      - b32hexdecode
      - b64decode
      - b85decode
      - z85decode
  condition: all of selection_*
falsepositives:
  - Legitimate use of Python for decoding data, which is uncommon in typical enterprise environments but possible in development or data analysis contexts.
level: high
license: DRL-1.1

What it detects

This rule flags Linux command-line executions of Python one-liners that import the base64 module and use base64 decoding functions (e.g., .decode, b16decode/b32decode/b64decode variants) via python -c style invocation. Attackers commonly use this pattern to obfuscate payloads and reduce detection by hiding executable content inside encoded strings that get decoded at runtime. The detection relies on process creation telemetry, matching the image path for python and specific command-line substrings indicating base64 usage and inline execution.

Known false positives

Legitimate use of Python for decoding data, which is uncommon in typical enterprise environments but possible in development or data analysis contexts.

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.