Windows Process Creation: Python One-Liners Decoding Base64 via Command Line
Alerts on Windows Python command-line one-liners that import base64 and call decode functions.
- Product
- windows
- Category
- process_creation
- Author
- Hugh Ryan (HueCodes), Swachchhanda Shrawan Poudel (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2026-03-09
- Updated
- 2026-07-30
ATT&CK techniques
Execution → Defense EvasionRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags Windows process executions where the command line indicates a Python one-liner importing base64 and invoking decoding functions. Attackers commonly use one-liners to decode obfuscated payloads or retrieve staged content, which can help evade simple content inspection. Detection relies on process creation telemetry, matching the executable image/name containing Python and the command line containing base64-related imports and decode function calls.
Reporting behind it
- docs.python.orghttps://docs.python.org/3/library/base64.html
- virustotal.comhttps://www.virustotal.com/gui/file/bc43e925d7b4b74319f6e74e836a96f1997ba404e14ac566cf12a21e9da463db/behavior
- cloud.google.comhttps://cloud.google.com/blog/topics/threat-intelligence/cybercriminals-weaponize-fake-ai-websites
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_python_base64_encoded_execution.yml
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Windows Process Creation: Python One-Liners Decoding Base64 via Command Line"
id: 93e3c428-f242-422d-b365-46431f7e8f3f
related:
- id: 55e862a8-dd9c-4651-807a-f21fcad56716
type: similar
- id: 50a0aa3d-ab16-4594-a8aa-5145a6e6792b
type: derived
status: experimental
description: This rule flags Windows process executions where the command line indicates a Python one-liner importing base64 and invoking decoding functions. Attackers commonly use one-liners to decode obfuscated payloads or retrieve staged content, which can help evade simple content inspection. Detection relies on process creation telemetry, matching the executable image/name containing Python and the command line containing base64-related imports and decode function calls.
references:
- https://docs.python.org/3/library/base64.html
- https://www.virustotal.com/gui/file/bc43e925d7b4b74319f6e74e836a96f1997ba404e14ac566cf12a21e9da463db/behavior
- https://cloud.google.com/blog/topics/threat-intelligence/cybercriminals-weaponize-fake-ai-websites
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_python_base64_encoded_execution.yml
author: Hugh Ryan (HueCodes), Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule Team
date: 2026-03-09
tags:
- attack.execution
- attack.stealth
- attack.t1059.006
- attack.t1027.010
logsource:
category: process_creation
product: windows
detection:
selection_img:
- Image|contains: \python
- OriginalFileName|contains: python
selection_cli:
CommandLine|contains|all:
- import
- base64
- " -c"
CommandLine|contains:
- .decode
- b16decode
- b32decode
- b32hexdecode
- b64decode
- b85decode
- z85decode
condition: all of selection_*
falsepositives:
- Legitimate use of Python for decoding data, which is uncommon in typical enterprise environments but possible in development or data analysis contexts.
level: high
regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_python_base64_encoded_execution/info.yml
license: DRL-1.1