Windows Process Creation: Python One-Liners Decoding Base64 via Command Line

Alerts on Windows Python command-line one-liners that import base64 and call decode functions.

FreeUnreviewedSigmahighv1

windows-process-creation-python-one-liners-decoding-base64-via-command-line-50a0aa3d

title: "Windows Process Creation: Python One-Liners Decoding Base64 via Command Line"
id: 93e3c428-f242-422d-b365-46431f7e8f3f
related:
  - id: 55e862a8-dd9c-4651-807a-f21fcad56716
    type: similar
  - id: 50a0aa3d-ab16-4594-a8aa-5145a6e6792b
    type: derived
status: experimental
description: This rule flags Windows process executions where the command line indicates a Python one-liner importing base64 and invoking decoding functions. Attackers commonly use one-liners to decode obfuscated payloads or retrieve staged content, which can help evade simple content inspection. Detection relies on process creation telemetry, matching the executable image/name containing Python and the command line containing base64-related imports and decode function calls.
references:
  - https://docs.python.org/3/library/base64.html
  - https://www.virustotal.com/gui/file/bc43e925d7b4b74319f6e74e836a96f1997ba404e14ac566cf12a21e9da463db/behavior
  - https://cloud.google.com/blog/topics/threat-intelligence/cybercriminals-weaponize-fake-ai-websites
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_python_base64_encoded_execution.yml
author: Hugh Ryan (HueCodes), Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule Team
date: 2026-03-09
tags:
  - attack.execution
  - attack.stealth
  - attack.t1059.006
  - attack.t1027.010
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    - Image|contains: \python
    - OriginalFileName|contains: python
  selection_cli:
    CommandLine|contains|all:
      - import
      - base64
      - " -c"
    CommandLine|contains:
      - .decode
      - b16decode
      - b32decode
      - b32hexdecode
      - b64decode
      - b85decode
      - z85decode
  condition: all of selection_*
falsepositives:
  - Legitimate use of Python for decoding data, which is uncommon in typical enterprise environments but possible in development or data analysis contexts.
level: high
regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_python_base64_encoded_execution/info.yml
license: DRL-1.1

What it detects

This rule flags Windows process executions where the command line indicates a Python one-liner importing base64 and invoking decoding functions. Attackers commonly use one-liners to decode obfuscated payloads or retrieve staged content, which can help evade simple content inspection. Detection relies on process creation telemetry, matching the executable image/name containing Python and the command line containing base64-related imports and decode function calls.

Known false positives

Legitimate use of Python for decoding data, which is uncommon in typical enterprise environments but possible in development or data analysis contexts.

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.