Linux Process Execution of Python Base64 Decode One-Liners

Alerts on Linux process creations running Python -c one-liners that import base64 and invoke decoding functions.

FreeReviewedSigma · High · v2

Product: linux
Category: process_creation
Author: Hugh Ryan (HueCodes), Swachchhanda Shrawan Poudel (Nextron Systems) (SigmaHQ), DRL 1.1
Published: 2026-03-09
Updated: 2026-07-31

ATT&CK techniques

Execution → Defense Evasion

Recon
Resource Dev
Initial Access
Execution
- T1059.006Python
Persistence
Priv Esc
Defense Evasion
- T1027.010Command Obfuscation
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule identifies Linux command-line executions that include Python imports and base64 decoding activity via common base64 decode functions within a Python one-liner style (e.g., using -c). Such usage is frequently associated with attackers decoding obfuscated content during execution to evade inspection. The detection relies on process creation telemetry that provides Image and CommandLine fields matching Python and base64 decode-related substrings.

Reporting behind it

Related detections9 linkedT1059.006 — drag to rearrange

Windows Process Creation: Python One-Liners Decoding Base64 via Command Line

Possible Trojanised Python Native Extension Load of gradient Module

Malicious AI CLI Anti-Attribution and Permission Bypass Flags

Suspicious Python HTTP Server Staging for Payload Delivery

Suspicious Python Base64 Encoded Command Execution (via process_creation)

Suspicious __init__.py Drop in Public Directory by Slow Pisces (via file_event)

Malicious Python Reverse Shell One-Liner Execution (via process_creation)

Suspicious Silver Fox Backdoor Execution via pythonw appclient Module (via process_creation)

Suspicious Malicious MCP Package devtools-assistant Execution (via process_creation)

Linux Process Execution of Python Base64 Decode One-Liners

Pivot detection · T1059.006 · 9 related

Changelog

v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

linux-process-executions-of-python-base64-decoding-in-one-liners-55e862a8

title: Linux Process Execution of Python Base64 Decode One-Liners
id: 9c054e2a-feac-45e8-abe9-ce4398cc8825
related:
  - id: 50a0aa3d-ab16-4594-a8aa-5145a6e6792b
    type: similar
  - id: 55e862a8-dd9c-4651-807a-f21fcad56716
    type: derived
status: experimental
description: This rule identifies Linux command-line executions that include Python imports and base64 decoding activity via common base64 decode functions within a Python one-liner style (e.g., using -c). Such usage is frequently associated with attackers decoding obfuscated content during execution to evade inspection. The detection relies on process creation telemetry that provides Image and CommandLine fields matching Python and base64 decode-related substrings.
references:
  - https://docs.python.org/3/library/base64.html
  - https://www.virustotal.com/gui/file/bc43e925d7b4b74319f6e74e836a96f1997ba404e14ac566cf12a21e9da463db/behavior
  - https://cloud.google.com/blog/topics/threat-intelligence/cybercriminals-weaponize-fake-ai-websites
  - https://github.com/SigmaHQ/sigma/blob/master/rules/linux/process_creation/proc_creation_lnx_python_base64_encoded_execution.yml
author: Hugh Ryan (HueCodes), Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule Team
date: 2026-03-09
tags:
  - attack.execution
  - attack.stealth
  - attack.t1059.006
  - attack.t1027.010
logsource:
  category: process_creation
  product: linux
detection:
  selection_img:
    Image|contains: /python
  selection_cli:
    CommandLine|contains|all:
      - import
      - base64
      - " -c"
    CommandLine|contains:
      - .decode
      - b16decode
      - b32decode
      - b32hexdecode
      - b64decode
      - b85decode
      - z85decode
  condition: all of selection_*
falsepositives:
  - Legitimate use of Python for decoding data, which is uncommon in typical enterprise environments but possible in development or data analysis contexts.
level: high
license: DRL-1.1

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL