Base64 Encoded MZ Header in Command Line
This rule detects the presence of a Base64 encoded MZ header within a command line. The MZ header is characteristic of Windows executable files. Its appearance in a command line, especially in a Base64 encoded format, often indicates an attempt to execute malicious code or a payload that has been obfuscated to evade detection. This technique is commonly used by attackers to deliver and execute malware.
Sigma
