Windows: Base64-Encoded PE “MZ” Header Present in Command Line
Alerts when Windows command lines include Base64 strings matching a PE “MZ” header.
FreeReviewedSigma · High · v1
- Product
- windows
- Category
- process_creation
- Author
- Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2022-07-12
- Updated
- 2026-07-30
What it detects
This rule flags Windows process creations where the command line contains Base64 strings consistent with a PE file starting with the “MZ” header. Attackers may use Base64-encoded payloads in command-line arguments to obfuscate execution content and evade basic inspection. The detection relies on process_creation telemetry and matching specific Base64-encoded header patterns within the CommandLine field.
Reporting behind it
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
windows-base64-encoded-pe-mz-header-present-in-command-line-22e58743
title: "Windows: Base64-Encoded PE “MZ” Header Present in Command Line"
id: 4cd06da8-9e06-48dc-a9cb-350eb46faead
status: test
description: This rule flags Windows process creations where the command line contains Base64 strings consistent with a PE file starting with the “MZ” header. Attackers may use Base64-encoded payloads in command-line arguments to obfuscate execution content and evade basic inspection. The detection relies on process_creation telemetry and matching specific Base64-encoded header patterns within the CommandLine field.
references:
- https://thedfirreport.com/2022/07/11/select-xmrig-from-sqlserver/
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_susp_inline_base64_mz_header.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-07-12
tags:
- attack.execution
logsource:
category: process_creation
product: windows
detection:
selection:
CommandLine|contains:
- TVqQAAMAAAAEAAAA
- TVpQAAIAAAAEAA8A
- TVqAAAEAAAAEABAA
- TVoAAAAAAAAAAAAA
- TVpTAQEAAAAEAAAA
condition: selection
falsepositives:
- Unlikely
level: high
license: DRL-1.1
related:
- id: 22e58743-4ac8-4a9f-bf19-00a0428d8c5f
type: derived