Linux Openssl Decode Pipe
This rule detects the use of 'openssl' or 'base64' for decoding data piped into a shell (bash, sh, zsh) or scripting interpreter (python, perl). This pattern is often used by adversaries to decode obfuscated commands or payloads directly into memory for execution, bypassing disk-based detection.
CQL
