detection.wiki

Detection rules › Sigma

Python One-Liners with Base64 Decoding

Status
experimental
Severity
high
Log source
product windows, category process_creation
Author
Hugh Ryan (HueCodes), Swachchhanda Shrawan Poudel (Nextron Systems)
Source
github.com/SigmaHQ/sigma

Detects Python one-liners that use base64 decoding functions in command line executions. Malicious scripts or attackers often use python one-liners to decode and execute base64-encoded payloads, which is a common technique for obfuscation and evasion.

MITRE ATT&CK coverage

TacticTechniques
ExecutionT1059.006 Command and Scripting Interpreter: Python
StealthT1027.010 Obfuscated Files or Information: Command Obfuscation

Event coverage

ProviderEventTitle
SysmonEvent ID 1Process creation

Rule body yaml

title: Python One-Liners with Base64 Decoding
id: 50a0aa3d-ab16-4594-a8aa-5145a6e6792b
related:
    - id: 55e862a8-dd9c-4651-807a-f21fcad56716
      type: similar
status: experimental
description: |
    Detects Python one-liners that use base64 decoding functions in command line executions.
    Malicious scripts or attackers often use python one-liners to decode and execute base64-encoded payloads, which is a common technique for obfuscation and evasion.
references:
    - https://docs.python.org/3/library/base64.html
    - https://www.virustotal.com/gui/file/bc43e925d7b4b74319f6e74e836a96f1997ba404e14ac566cf12a21e9da463db/behavior
    - https://cloud.google.com/blog/topics/threat-intelligence/cybercriminals-weaponize-fake-ai-websites
author: Hugh Ryan (HueCodes), Swachchhanda Shrawan Poudel (Nextron Systems)
date: 2026-03-09
tags:
    - attack.execution
    - attack.stealth
    - attack.t1059.006
    - attack.t1027.010
logsource:
    category: process_creation
    product: windows
detection:
    selection_img:
        - Image|contains: '\python'
        - OriginalFileName|contains: 'python'
    selection_cli:
        CommandLine|contains|all:
            - 'import'
            - 'base64'
            - ' -c'
        CommandLine|contains:
            - '.decode'
            - 'b16decode'
            - 'b32decode'
            - 'b32hexdecode'
            - 'b64decode'
            - 'b85decode'
            - 'z85decode'
    condition: all of selection_*
falsepositives:
    - Legitimate use of Python for decoding data, which is uncommon in typical enterprise environments but possible in development or data analysis contexts.
level: high
regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_python_base64_encoded_execution/info.yml

Stages and Predicates

Stage 0: condition

all of selection_*

Stage 1: selection_img

selection_img:
    - Image|contains: '\python'
    - OriginalFileName|contains: 'python'

Stage 2: selection_cli

selection_cli:
    CommandLine|contains|all:
        - 'import'
        - 'base64'
        - ' -c'
    CommandLine|contains:
        - '.decode'
        - 'b16decode'
        - 'b32decode'
        - 'b32hexdecode'
        - 'b64decode'
        - 'b85decode'
        - 'z85decode'

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

FieldKindValues
CommandLinematch
  • -c corpus 5 (sigma 5)
  • .decode corpus 2 (sigma 2)
  • b16decode corpus 2 (sigma 2)
  • b32decode corpus 2 (sigma 2)
  • b32hexdecode corpus 2 (sigma 2)
  • b64decode corpus 4 (sigma 2, elastic 2)
  • b85decode corpus 2 (sigma 2)
  • base64 corpus 11 (sigma 7, elastic 4)
  • import corpus 4 (sigma 4)
  • z85decode corpus 2 (sigma 2)
Imagematch
  • \python corpus 3 (sigma 3)
OriginalFileNamematch
  • python