ATT&CK T1027 - Base64 Encoded Payload in HTTP Body

Darshan Thummar@Mighty

•updated Jun 10, 2026•0•0•1

This rule detects the presence of a large Base64 encoded string (at least 100 characters) within the HTTP client body of network traffic. This pattern is often used by attackers to obfuscate malicious payloads, aligning with the MITRE ATT&CK technique T1027 for Defense Evasion.