Linux Processes Using Base64 Input Piped to Shell (bash/sh)

Flags Linux command lines that use base64-encoded data piped into bash or sh for execution.

FreeUnreviewedSigmamediumv1

linux-processes-using-base64-input-piped-to-shell-bash-sh-ba592c6d

title: Linux Processes Using Base64 Input Piped to Shell (bash/sh)
id: ac582613-e78f-44f8-a240-b39c7b812993
status: test
description: This rule identifies Linux process command lines that include a base64-encoded input followed by piping to a shell interpreter (bash or sh). Attackers commonly use base64 to obfuscate payloads in transit and reduce the visibility of recognizable script or command content. The detection relies on Linux process creation telemetry, matching specific command-line substrings and suffixes that indicate base64 usage and a pipe to bash/sh.
references:
  - https://github.com/arget13/DDexec
  - https://www.mandiant.com/resources/blog/barracuda-esg-exploited-globally
  - https://github.com/SigmaHQ/sigma/blob/master/rules/linux/process_creation/proc_creation_lnx_base64_execution.yml
author: pH-T (Nextron Systems), Huntrule Team
date: 2022-07-26
modified: 2023-06-16
tags:
  - attack.stealth
  - attack.t1140
logsource:
  product: linux
  category: process_creation
detection:
  selection_base64:
    CommandLine|contains: "base64 "
  selection_exec:
    - CommandLine|contains:
        - "| bash "
        - "| sh "
        - "|bash "
        - "|sh "
    - CommandLine|endswith:
        - " |sh"
        - "| bash"
        - "| sh"
        - "|bash"
  condition: all of selection_*
falsepositives:
  - Legitimate administration activities
level: medium
license: DRL-1.1
related:
  - id: ba592c6d-6888-43c3-b8c6-689b8fe47337
    type: derived

What it detects

This rule identifies Linux process command lines that include a base64-encoded input followed by piping to a shell interpreter (bash or sh). Attackers commonly use base64 to obfuscate payloads in transit and reduce the visibility of recognizable script or command content. The detection relies on Linux process creation telemetry, matching specific command-line substrings and suffixes that indicate base64 usage and a pipe to bash/sh.

Known false positives

Legitimate administration activities

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.