Linux Base64 Encoded Pipe to Shell

calendar Aug 12, 2024 · attack.defense-evasion attack.t1140  ·
Share on: linkedin copy

Detects suspicious process command line that uses base64 encoded input for execution with a shell

Sigma rule (View on GitHub)

 1title: Linux Base64 Encoded Pipe to Shell
 2id: ba592c6d-6888-43c3-b8c6-689b8fe47337
 3status: test
 4description: Detects suspicious process command line that uses base64 encoded input for execution with a shell
 5references:
 6    - https://github.com/arget13/DDexec
 7    - https://www.mandiant.com/resources/blog/barracuda-esg-exploited-globally
 8author: pH-T (Nextron Systems)
 9date: 2022-07-26
10modified: 2023-06-16
11tags:
12    - attack.defense-evasion
13    - attack.t1140
14logsource:
15    product: linux
16    category: process_creation
17detection:
18    selection_base64:
19        CommandLine|contains: 'base64 '
20    selection_exec:
21        - CommandLine|contains:
22              - '| bash '
23              - '| sh '
24              - '|bash '
25              - '|sh '
26        - CommandLine|endswith:
27              - ' |sh'
28              - '| bash'
29              - '| sh'
30              - '|bash'
31    condition: all of selection_*
32falsepositives:
33    - Legitimate administration activities
34level: medium

References

Related rules

to-top