Python One-Liners with Base64 Decoding - Linux

Hunt Hypothesis

Detects the use of Python’s base64 decoding functions in command line executions on Linux systems. Malicious scripts often use python one-liners to decode and execute base64-encoded payloads, which is

Detection Rule

Sigma (Original)

title: Python One-Liners with Base64 Decoding - Linux
id: 55e862a8-dd9c-4651-807a-f21fcad56716
related:
    - id: 50a0aa3d-ab16-4594-a8aa-5145a6e6792b
      type: similar
status: experimental
description: |
    Detects the use of Python's base64 decoding functions in command line executions on Linux systems.
    Malicious scripts often use python one-liners to decode and execute base64-encoded payloads, which is a common technique for obfuscation and evasion.
references:
    - https://docs.python.org/3/library/base64.html
    - https://www.virustotal.com/gui/file/bc43e925d7b4b74319f6e74e836a96f1997ba404e14ac566cf12a21e9da463db/behavior
    - https://cloud.google.com/blog/topics/threat-intelligence/cybercriminals-weaponize-fake-ai-websites
author: Hugh Ryan (HueCodes), Swachchhanda Shrawan Poudel (Nextron Systems)
date: 2026-03-09
tags:
    - attack.execution
    - attack.t1059.006
    - attack.defense-evasion
    - attack.t1027.010
logsource:
    category: process_creation
    product: linux
detection:
    selection_img:
        Image|contains: '/python'
    selection_cli:
        CommandLine|contains|all:
            - 'import'
            - 'base64'
            - ' -c'
        CommandLine|contains:
            - '.decode'
            - 'b16decode'
            - 'b32decode'
            - 'b32hexdecode'
            - 'b64decode'
            - 'b85decode'
            - 'z85decode'
    condition: all of selection_*
falsepositives:
    - Legitimate use of Python for decoding data, which is uncommon in typical enterprise environments but possible in development or data analysis contexts.
level: high

KQL (Azure Sentinel)

imProcessCreate
| where TargetProcessName contains "/python" and ((TargetProcessCommandLine contains "import" and TargetProcessCommandLine contains "base64" and TargetProcessCommandLine contains " -c") and (TargetProcessCommandLine contains ".decode" or TargetProcessCommandLine contains "b16decode" or TargetProcessCommandLine contains "b32decode" or TargetProcessCommandLine contains "b32hexdecode" or TargetProcessCommandLine contains "b64decode" or TargetProcessCommandLine contains "b85decode" or TargetProcessCommandLine contains "z85decode"))

Required Data Sources

False Positive Guidance

• Legitimate use of Python for decoding data, which is uncommon in typical enterprise environments but possible in development or data analysis contexts.

MITRE ATT&CK Context

• Tactic: Execution
• Tactic: Defense Evasion
• Technique: T1059.006 — T1059.006
• Technique: T1027.010 — T1027.010

References

• https://docs.python.org/3/library/base64.html
• https://www.virustotal.com/gui/file/bc43e925d7b4b74319f6e74e836a96f1997ba404e14ac566cf12a21e9da463db/behavior
• https://cloud.google.com/blog/topics/threat-intelligence/cybercriminals-weaponize-fake-ai-websites
• SigmaHQ Rule