Sessiongate Numeric And Base64 Argument Gate

Daniel Jeremiah@daniyyell

•updated Jun 20, 2026•2•1•7

Detects an executable containing numeric argument parsing and Base64 decoding routines used as a staged execution gate. This YARA rule specifically looks for the presence of API calls related to command-line argument parsing (CommandLineToArgvW, atoi, strtoul) and Base64 decoding (CryptStringToBinary) within an executable, which are indicative of malware like Sessiongate.