BIOC
Informational
✕
Base64 encoding used
Attackers may use the base64 built-in binary to encode data into base64.
- Module:
- Platform Analytics
- Agent event type:
- Process execution
- Category:
- Collection
- Status:
- Enabled
ATT&CK tactics: Command and Control (TA0011)
ATT&CK techniques: Data Encoding (T1132)
Indicator:
Process action type = execution AND target process cmd != *-d* AND target process cmd != base64 AND base64 /dev/urandom AND base64 -w0 AND base64 --version AND base64 --help AND base64 -h AND *improbable* AND *bootstrap* AND target process name = base64 Process initiator cmd != *build*.sh* AND cgo name != containerd
Preventable: yes