Linux Process Execution of Python Base64 Decode One-Liners
Alerts on Linux process creations running Python -c one-liners that import base64 and invoke decoding functions.
- Product
- linux
- Category
- process_creation
- Author
- Hugh Ryan (HueCodes), Swachchhanda Shrawan Poudel (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2026-03-09
- Updated
- 2026-07-31
ATT&CK techniques
Execution → Defense EvasionRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule identifies Linux command-line executions that include Python imports and base64 decoding activity via common base64 decode functions within a Python one-liner style (e.g., using -c). Such usage is frequently associated with attackers decoding obfuscated content during execution to evade inspection. The detection relies on process creation telemetry that provides Image and CommandLine fields matching Python and base64 decode-related substrings.
Reporting behind it
- docs.python.orghttps://docs.python.org/3/library/base64.html
- virustotal.comhttps://www.virustotal.com/gui/file/bc43e925d7b4b74319f6e74e836a96f1997ba404e14ac566cf12a21e9da463db/behavior
- cloud.google.comhttps://cloud.google.com/blog/topics/threat-intelligence/cybercriminals-weaponize-fake-ai-websites
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/linux/process_creation/proc_creation_lnx_python_base64_encoded_execution.yml
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Linux Process Execution of Python Base64 Decode One-Liners
id: 9c054e2a-feac-45e8-abe9-ce4398cc8825
related:
- id: 50a0aa3d-ab16-4594-a8aa-5145a6e6792b
type: similar
- id: 55e862a8-dd9c-4651-807a-f21fcad56716
type: derived
status: experimental
description: This rule identifies Linux command-line executions that include Python imports and base64 decoding activity via common base64 decode functions within a Python one-liner style (e.g., using -c). Such usage is frequently associated with attackers decoding obfuscated content during execution to evade inspection. The detection relies on process creation telemetry that provides Image and CommandLine fields matching Python and base64 decode-related substrings.
references:
- https://docs.python.org/3/library/base64.html
- https://www.virustotal.com/gui/file/bc43e925d7b4b74319f6e74e836a96f1997ba404e14ac566cf12a21e9da463db/behavior
- https://cloud.google.com/blog/topics/threat-intelligence/cybercriminals-weaponize-fake-ai-websites
- https://github.com/SigmaHQ/sigma/blob/master/rules/linux/process_creation/proc_creation_lnx_python_base64_encoded_execution.yml
author: Hugh Ryan (HueCodes), Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule Team
date: 2026-03-09
tags:
- attack.execution
- attack.stealth
- attack.t1059.006
- attack.t1027.010
logsource:
category: process_creation
product: linux
detection:
selection_img:
Image|contains: /python
selection_cli:
CommandLine|contains|all:
- import
- base64
- " -c"
CommandLine|contains:
- .decode
- b16decode
- b32decode
- b32hexdecode
- b64decode
- b85decode
- z85decode
condition: all of selection_*
falsepositives:
- Legitimate use of Python for decoding data, which is uncommon in typical enterprise environments but possible in development or data analysis contexts.
level: high
license: DRL-1.1