Suspicious Linux Base64 Encoded Shebang In CLI (via process_creation)

title: Suspicious Linux Base64 Encoded Shebang In CLI (via process_creation)
id: f5214d2c-5a87-525f-bf3c-6045374c0132
status: stable
description: This rule detects the presence of a base64 version of the shebang in the commandline, which could indicate a hostile payload about to be decoded
references:
    - https://attack.mitre.org/techniques/T1140/
    - https://www.trendmicro.com/pl_pl/research/20/i/the-evolution-of-malicious-shell-scripts.html
    - https://github.com/carlospolop/PEASS-ng/tree/master/linPEAS
author: Huntrule Team
date: 2026-01-22
tags:
    - attack.stealth
    - attack.t1140
logsource:
    product: linux
    category: process_creation
detection:
    selection:
        CommandLine|contains:
            - "IyEvYmluL2Jhc2"
            - "IyEvYmluL2Rhc2"
            - "IyEvYmluL3pza"
            - "IyEvYmluL2Zpc2"
            - "IyEvYmluL3No"
    condition: selection
falsepositives:
    - Unknown
level: medium