Linux Base64 Encoded Shebang In CLI

SigmaHQ Detections@sigmaHQ

•updated Apr 28, 2026•0•0•0

Detects the presence of a base64 version of the shebang in the commandline, which could indicate a malicious payload about to be decoded