cscli scenarios install crowdsecurity/auditd-base64-exec-behaviorAttempt to detect a process that is invoking both base64 and an interpreter such as sh, bash, perl, dash, zsh or python.
This pattern is usually seen in post-exploitation behaviors to have "file less" backdoors :
1echo ZWNobyAnbWFsaWNpb3VzIHBheWxvYWQnCg== | base64 -d | bash
1type: conditional2#debug: true3name: crowdsecurity/auditd-base64-exec-behavior4description: "Detect post-exploitation behaviour : base64 + interpreter (perl/bash/python)"5filter: evt.Meta.log_type == 'execve'6#grouping by ppid to track a processs invoking base64 and interpreter in sequence7groupby: evt.Meta.ppid8condition: |9 any(queue.Queue, {.Meta.exe == "/usr/bin/base64"})10 and (11 any(queue.Queue, { .Meta.exe matches '^\\/(usr\\/(local\\/)?)?bin\\/(sh|bash|perl|dash|zsh)$' })12 or13 any(queue.Queue, { .Meta.exe startsWith "/usr/bin/python" })14 )15leakspeed: 1s16capacity: -117blackhole: 1m18labels:19 service: linux20 confidence: 221 spoofable: 022 classification:23 - attack.T1059.00424 behavior: "linux:post-exploitation"25 label: "Post Exploitation command execution from base64 encoded payload"26 remediation: false27scope:28 type: pid29 expression: evt.Meta.ppid30