Process Launched with Base64-Encoded --b Argument for C2 Config Smuggling

Kaung Khant Ko@kaungkhantko

•updated Jul 15, 2026•0•0•0

This rule detects process execution attempts where specific arguments (such as '--b' or '-b') are used alongside strings associated with malicious C2 configuration, such as command-line flags for server, key, group, organization identifiers, or external domain references. This behavior is indicative of command-line obfuscation and the smuggling of C2 configuration data within process launch arguments, a technique often used to evade signature-based security controls.