Linux Base64 Encoded Command Piped to Shell

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•3•0•29

Detects suspicious command-line activity on Linux systems where base64 encoded input is piped directly into a shell for execution. This technique is often used by adversaries for defense evasion and to obfuscate malicious commands.