Shell one-liner encodes data and pipes it to a network transfer tool

Siemphony@siemphonymediumT1132unverified

Matches AN0303's Linux observable: a single shell invocation that both names a binary-to-text or compression encoder and a network transfer tool, which is how a piped one-liner (`... | base64 | curl -d @- http://...`) actually surfaces on the process_creation category — auditd's own type=EXECVE record carries only one program's argv, so this rule matches the interpreter's own record, written when a caller passes the whole pipeline as a single string to `sh -c`/`bash -c`, as cron, a downloader stage, a configuration-management task or a webshell all commonly do. It cannot see the equivalent typed interactively at a live shell, or run from a script file invoked by path, where the encoder and the transfer tool are separate child processes with no shared field to join across. Prerequisite: auditd ships no execve rule by default, so without an explicit -a always,exit -F arch=b64 -S execve there is no process_creation telemetry on the host at all and this rule returns zero rows regardless of what ran — the silence means the syscall is not being recorded, not that the host is quiet. This is deliberately distinct from the technique's Windows sub-techniques T1132.001 and T1132.002, both scoped to PowerShell Script Block Logging and 4104 events that do not exist on Linux, and from T1048.001's openssl/gpg selectors, which match encryption keywords rather than encoding-and-transfer in one line. Of AN0303's two knobs, UserContext is the usable one here — scoping out build and orchestration service accounts is the tuning that removes most of the noise below — while TimeWindow assumes the encode and the transfer arrive as two correlatable events, which is exactly what this rule collapses into a single record and therefore cannot apply. UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0108, not hand-written and not tested by its author. Any lab result is on this rule's own page.Full description

The 4 SIEM queries below are previews produced by Siemphony’s own translator, not pySigma, and none has been executed against a real backend — review before you deploy.

detection.yml

Sentinel · KQL

Run this as a search.

DeviceProcessEvents| where (((FolderPath endswith "/bash" or FolderPath endswith "/sh" or FolderPath endswith "/dash") and (ProcessCommandLine contains "base64" or ProcessCommandLine contains "gzip" or ProcessCommandLine contains "xxd" or ProcessCommandLine contains "uuencode" or ProcessCommandLine contains "b64encode")) and (ProcessCommandLine contains "curl" or ProcessCommandLine contains "wget" or ProcessCommandLine contains "netcat" or ProcessCommandLine contains " nc "))

Splunk · SPL

Run this as a search.

index=* (((Image="*/bash" OR Image="*/sh" OR Image="*/dash") AND (CommandLine="*base64*" OR CommandLine="*gzip*" OR CommandLine="*xxd*" OR CommandLine="*uuencode*" OR CommandLine="*b64encode*")) AND (CommandLine="*curl*" OR CommandLine="*wget*" OR CommandLine="*netcat*" OR CommandLine="* nc *"))

Elastic · ES|QL

Run this as a search.

FROM logs-*| WHERE (((TO_LOWER(process.executable) LIKE "*/bash" OR TO_LOWER(process.executable) LIKE "*/sh" OR TO_LOWER(process.executable) LIKE "*/dash") AND (TO_LOWER(process.command_line) LIKE "*base64*" OR TO_LOWER(process.command_line) LIKE "*gzip*" OR TO_LOWER(process.command_line) LIKE "*xxd*" OR TO_LOWER(process.command_line) LIKE "*uuencode*" OR TO_LOWER(process.command_line) LIKE "*b64encode*")) AND (TO_LOWER(process.command_line) LIKE "*curl*" OR TO_LOWER(process.command_line) LIKE "*wget*" OR TO_LOWER(process.command_line) LIKE "*netcat*" OR TO_LOWER(process.command_line) LIKE "* nc *"))

Wazuh · XML rule

Deploy to your manager — this is a rule, not a search.

<group name="sigma,linux,process_creation,">  <!-- Rule ids must be unique on your manager; 100000+ is the user range. -->  <rule id="100000" level="7">    <!-- Set <if_sid> to the decoder/base rule for linux so this only evaluates relevant events. -->    <field name="Image" type="pcre2">(?i)(/bash$|/sh$|/dash$)</field>    <field name="CommandLine" type="pcre2">(?i)(base64|gzip|xxd|uuencode|b64encode)</field>    <field name="CommandLine" type="pcre2">(?i)(curl|wget|netcat| nc )</field>    <description>Shell one-liner encodes data and pipes it to a network transfer tool</description>    <mitre>      <id>T1132</id>    </mitre>  </rule></group>

At a glance

Logsource: process_creation / linux
Level: medium
Category: obfuscated_payloads
Sigma status: experimental
Backends: 4 of 4 rendered
Updated: 30 Aug 2026
Rule ID: ae1169e5-82cb-4aef-b6c6-e1aaaff773f1

ATT&CKT1132

T1132Data Encoding

ATT&CK® is a registered trademark of The MITRE Corporation. These mappings are the rule author’s, and are neither reviewed nor endorsed by MITRE.

Lessonobfuscated payloads

obfuscated payloads

01 · What this rule detects

Content made deliberately unreadable before it runs — a base64 or hex blob passed on a command line, a script assembled from concatenated fragments, a packed or encrypted file on disk, and the decode step that has to happen before any of it executes. The obfuscation itself is not the finding; the transition from encoded to executed is. Guardrailed payloads belong here too, where the key is derived from the victim's domain or hostname so the content only decodes on the intended machine and never in your sandbox.

02 · Telemetry you need

Sysmon EventID 1 CommandLine, ParentImage and OriginalFileName, complete and untruncated — Security 4688 needs Audit Process Creation for the event and the separate 'Include command line in process creation events' policy for the arguments, and without the second one you get the image name and none of the encoding
PowerShell script block logging (EventID 4104), which records the content after decoding — off by default, and long blocks are split across several events with MessageNumber and MessageTotal, so a contains match on one event misses any string that straddles the split
Sysmon EventID 11 (FileCreate) for the decoded payload written to disk and EventID 7 (ImageLoad) for what is loaded straight afterwards — a reflectively loaded module produces no EventID 7 at all, so absence here proves nothing
auditd execve records on Linux — the rule must be loaded in /etc/audit/rules.d or nothing is captured, and any argument containing whitespace or non-printable characters is written hex-encoded rather than as text, so a match written against the plaintext string silently never fires
Antimalware Scan Interface telemetry where your endpoint product exposes it: it sees the buffer after decoding, but only for the runtimes that call it — PowerShell, the Windows Script Host, VBA and .NET — never a native loader

03 · How the logic works

Start with the trap, because it is the reason most rules in this category are unusable: base64 on a command line is overwhelmingly benign. Installers pass encoded configuration, telemetry agents pass encoded payloads, deployment tooling ships whole scripts as -EncodedCommand, and scheduled tasks are registered with base64 arguments by products nobody considers suspicious. 'Contains base64' and 'high entropy' are therefore not detections — entropy measures compressibility, not intent, and certificates, GUIDs, JWTs, minified JavaScript and packed commercial binaries all score exactly as high as a packed implant. Entropy is a ranking signal for triage, not a firing condition.

What makes it a detection is base64 plus a decode-and-execute pair in the same command line or the same script block: FromBase64String alongside Invoke-Expression, IEX or .Invoke(); certutil -decode followed by execution of what it wrote; base64 -d piped into sh or bash; eval over a decoded string. Match the pair, not the blob. One useful specific: -EncodedCommand payloads are UTF-16LE before encoding, so a decoded ASCII keyword appears as a predictable base64 fragment — but the fragment depends on the byte offset the string starts at, so you need all three alignments of each keyword or the match is a coin flip.

The second family is character-level obfuscation rather than encoding: carets in cmd, backticks and the format operator in PowerShell, %VAR:~n,m% substring expansion, quotes inserted mid-token, variables assembled and then invoked. Match density rather than presence. One caret is a normal escape; fifteen carets in one command line is not a command line anyone typed. Finally, execution guardrails cap what any of this can achieve: if the key is derived from the environment, you may never observe the decoded content at all, and the guardrail check is made of ordinary API calls that make a poor rule. That is an argument for keeping the file-write and image-load rules alongside the command-line ones, not for writing a rule against the guardrail.

04 · Common false positives

Intune, Configuration Manager and similar deployment platforms, which run detection and remediation scripts as -EncodedCommand by design — this is normally the single highest-volume match in the category
certutil -encode and -decode used by administrators and certificate enrolment scripts to move certificate material around as text
Monitoring, backup and inventory agents that register scheduled tasks with a base64 argument, then run them on a fixed schedule from every host in the estate
Minified and bundled JavaScript, source maps and web application build output, which trip entropy and long-string rules written against file content
Commercially packed and protected binaries — DRM wrappers, anti-cheat, licence protection — whose sections have the same entropy profile as a packer because they are one
Cloud and container CLI usage, where secrets, kubeconfigs and manifests are routinely base64 on the command line

05 · Detection maturity

Tier 1 — starting point: Matches -EncodedCommand and similar encoding flags, or a base64-shaped string, anywhere on a command line.
Tier 2 — tuned: Requires encoding together with a decode-and-execute pair or a high density of escape characters, with deployment tooling excluded by signed parent path.
Tier 3 — correlated: Reads the decoded content from script block logging or enrichment and scores on what the decoded command actually does, the parent chain, and whether the payload was written to disk or loaded in memory afterwards.

Tuning & false positivesexperimental · 4 declared

experimental (current stage)
test
stable

Written and reasoned about, but not yet run against real telemetry. Expect to tune it before trusting it.

Tuning tips

Require the pair: encoding plus a decode call plus an execution sink. A rule that fires on the encoding alone will be turned off within a week and will have taught the author that the category does not work
Exclude deployment tooling by the full signed path of the parent process, never by the encoded string — the string is the attacker's half and the parent is not
Match parameter prefixes case-insensitively and cover the dash variants: PowerShell accepts -e, -en, -enc and any longer prefix of -EncodedCommand, and Sigma's windash modifier handles the separator forms
Decode the blob during enrichment so the alert carries the plaintext — an alert that says only 'encoded command observed' hands the analyst the same work the rule was supposed to do
Use payload length as a cheap second condition; a several-thousand-character blob is a different population from a forty-character one, and the split is usually visible in a day of your own data
Where script block logging is enabled, make 4104 the primary source and keep the command-line rule as coverage for the runtimes 4104 cannot see — and account for the multi-event split when you write the match

Declared by the author

CI/CD build and deployment one-liners that base64- or gzip-encode an artifact and curl it to an internal registry or API — this is a routine pattern in container build scripts and deploy hooks and is the single largest source of noise in build infrastructure.
Configuration-management and orchestration tooling — Ansible, SaltStack, Chef — which runs provisioning tasks as sh -c "<whole line>" as its normal mechanism, the exact invocation shape this rule keys on. Any task that both encodes something and curls or wgets it matches identically to a build one-liner.
Shell installer scripts that fetch a payload with curl or wget and pipe it through base64 --decode before unpacking it, when the whole pipeline is passed as one sh -c or bash -c argument (a Dockerfile RUN step, a cron line, a CM shell task). The direction is inbound, not exfiltration, but the vocabulary is identical.
Diagnostic and support-bundle scripts that gzip a log collection and upload it with curl or wget to a vendor endpoint, again only where the collection and upload share one sh -c line rather than living in a script file the agent invokes by path.

Noise check0 of 4 fired

Fires on none of the 4 ordinary behaviours the baseline holds for this log type. That is not a precision guarantee: it means only not caught by these 4 behaviours, and the next ordinary behaviour nobody wrote down may still match.

Run live against 65 hand-written events of ordinary corporate activity — backup agents, software distribution, patching, helpdesk scripts, EDR. It says nothing about how often the rule would fire in production, which is the number that actually exhausts an analyst.

Verification1 run

Not verified

Siemphony benign baseline
completed
Siemphony IR · 3 Sept 2026
No events matched, so this run proves nothing either way.

Test it yourselfin your browser

Runs here in your browser against public attack recordings. A preview — not the verification badge.

Recordings of T1132, evaluated against their process_creation events.

Share this rule

/u/siemphony/ae1169e5-82cb-4aef-b6c6-e1aaaff773f1

More from this repertoire

All compositions

Verdicts · reactions · comments

Community

Verdicts from engineers who actually deployed it, and the conversation around it.

Not yet reported on

Nobody has run this in a real environment and said what happened.

Verdicts from engineers who deployed it

0 cast

No verdicts reported yet. The first one is worth more than the tenth — say what you ran it against.

No comments yet. Someone who deploys this will have something to say about it.

Shell one-liner encodes data and pipes it to a network transfer tool

The detection

detection.yml

Sentinel · KQL

Splunk · SPL

Elastic · ES|QL

Wazuh · XML rule

Community

Verdicts from engineers who deployed it