Linux Base64 Encoded Shebang in Command Line

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•3•0•24

This rule detects the presence of base64 encoded shebangs (e.g., #!/bin/bash) within command-line arguments. Adversaries often encode commands to evade detection and obfuscate their malicious intent. The rule specifically looks for the base64 representations of common shell shebangs, indicating that a script or command containing these might be decoded and executed.