Void Dokkaebi - Base64 Reverse Shell Execution

Ibrahim Saud@tektrix

•updated Jun 21, 2026•1•0•9

Detects the decoded execution of bash/sh reverse shells initiated from processes like node.exe or python.exe, which is indicative of the Void Dokkaebi threat actor's tactics. The rule specifically looks for command lines containing 'echo' with base64 encoded strings, followed by 'base64 -d' and then 'sh' or 'bash' for execution.