Linux Process Creation: Base64-Encoded Pipe to Bash/Sh Execution

Flags Linux command lines that use base64-encoded data piped into bash or sh for execution.

FreeReviewedSigma · Medium · v3

Product: linux
Category: process_creation
Author: pH-T (Nextron Systems) (SigmaHQ), DRL 1.1
Published: 2022-07-26
Updated: 2026-07-31

ATT&CK techniques

Defense Evasion

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
- T1140Deobfuscate/Decode Files or Information
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule identifies Linux processes whose command line includes a base64-encoded payload that is piped into a shell interpreter such as bash or sh. Attackers commonly use base64 encoding to obscure command content while executing it through standard shell pipelines. The detection relies on process creation telemetry capturing the full command line, matching for the presence of 'base64 ' and pipe patterns that lead into 'bash' or 'sh'.

Reporting behind it

Related detections9 linkedT1140 — drag to rearrange

Suspicious Shell Command Obfuscation via printf Escape Encoding on VMware ESXi (via process_creation)

Hidden PowerShell Archive Extraction via ExtractToDirectory

Malicious Shell Payload Piped from curl to zsh

CastleLoader ClickFix PowerShell Hex Decode and Re-Execution

Suspicious Cabinet Extraction of Masqueraded vstm Archive via extrac32

Suspicious tar Extraction of Staged Archive to Temp (via process_creation)

Malicious Multi Layer Base64 Decoded Payload Execution via Bash (via process_creation)

Malicious Certutil Decode of Encoded Web Shell to ASPX (via process_creation)

Obfuscated File Decoding via Certutil (via process_creation)

Linux Process Creation: Base64-Encoded Pipe to Bash/Sh Execution

Pivot detection · T1140 · 9 related

Changelog

v3
Candidate ingested via manual entry.2026-07-31
v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

linux-processes-using-base64-input-piped-to-shell-bash-sh-ba592c6d

title: "Linux Process Creation: Base64-Encoded Pipe to Bash/Sh Execution"
id: ac582613-e78f-44f8-a240-b39c7b812993
status: test
description: This rule identifies Linux processes whose command line includes a base64-encoded payload that is piped into a shell interpreter such as bash or sh. Attackers commonly use base64 encoding to obscure command content while executing it through standard shell pipelines. The detection relies on process creation telemetry capturing the full command line, matching for the presence of 'base64 ' and pipe patterns that lead into 'bash' or 'sh'.
references:
  - https://github.com/arget13/DDexec
  - https://www.mandiant.com/resources/blog/barracuda-esg-exploited-globally
  - https://github.com/SigmaHQ/sigma/blob/master/rules/linux/process_creation/proc_creation_lnx_base64_execution.yml
author: pH-T (Nextron Systems), Huntrule Team
date: 2022-07-26
modified: 2023-06-16
tags:
  - attack.stealth
  - attack.t1140
logsource:
  product: linux
  category: process_creation
detection:
  selection_base64:
    CommandLine|contains: "base64 "
  selection_exec:
    - CommandLine|contains:
        - "| bash "
        - "| sh "
        - "|bash "
        - "|sh "
    - CommandLine|endswith:
        - " |sh"
        - "| bash"
        - "| sh"
        - "|bash"
  condition: all of selection_*
falsepositives:
  - Legitimate administration activities
level: medium
license: DRL-1.1
related:
  - id: ba592c6d-6888-43c3-b8c6-689b8fe47337
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL