Long Base64 Encoded Command via Scripting Interpreter
Description
Identifies oversized command lines used by Python, PowerShell, Node.js, or Deno that contain base64 decoding or encoded-command patterns. Adversaries may embed long inline encoded payloads in scripting interpreters to evade inspection and execute malicious content across Windows, macOS, and Linux systems.
Query · esql
FROM logs-endpoint.events.process-* METADATA _id, _index, _version, _ignored
| MV_EXPAND _ignored
| WHERE _ignored == "process.command_line"
| WHERE event.category == "process" and event.type == "start"
| EVAL command_line = TO_LOWER(process.command_line.text),
pname = TO_LOWER(process.name)
| EVAL has_long_base64 = command_line RLIKE """.*[a-z0-9+/]{100,}={0,2}.*"""
| WHERE
(
(
/* Python: decode primitive + plausible Base64 payload */
pname LIKE "python*" AND
has_long_base64 AND
(
command_line LIKE "*b64decode*" OR
(command_line LIKE "*-c*" AND command_line LIKE "*base64*")
) AND NOT (process.parent.name == "codex" AND (command_line LIKE "*.write(base64.*" or command_line LIKE "*.write_bytes(base64*"))
) OR
(
/* PowerShell: encoded command or explicit Base64 decode + payload */
(pname LIKE "powershell*" OR pname LIKE "pwsh*") AND
has_long_base64 AND
(
command_line RLIKE """.* -(e|en|enc|enco|encod|encode|encoded|encodedcommand) .+""" OR
command_line LIKE "*-encodedcommand*" OR
command_line LIKE "*frombase64string*"
)
) OR
(
/* Node.js */
pname LIKE "node*" AND
has_long_base64 AND
(
(command_line LIKE "*buffer.from*" AND command_line LIKE "*base64*") OR
command_line LIKE "*atob(*"
)
) OR
(
/* Deno */
pname LIKE "deno*" AND
has_long_base64 AND
(
command_line LIKE "*atob(*" OR
(command_line LIKE "*buffer.from*" AND command_line LIKE "*base64*") OR
command_line LIKE "*eval(*"
)
)
)
| EVAL Esql.length_cmdline = LENGTH(command_line)
| WHERE Esql.length_cmdline >= 4000
| DROP _ignored, pname, has_long_base64
| KEEP @timestamp, _id, _version, _index, data_stream.namespace,
user.name, user.id, host.name, host.id, agent.id,
process.entity_id, process.executable,
process.parent.entity_id, process.parent.executable,
process.command_line.text, process.parent.command_line
Analyst notes
Investigating Long Base64 Encoded Command via Scripting Interpreter
This rule detects process start events where the original process.command_line field was ignored at index time due to
its size, but the full command line remains available in process.command_line.text. Attackers commonly use very long
base64-encoded inline commands with interpreters such as Python, PowerShell, Node.js, and Deno to conceal payloads and
avoid straightforward command-line inspection.
Possible investigation steps
- Review
process.command_line.textto determine whether the encoded content includes shell commands, scripts, URLs, or embedded payloads. - Inspect the parent process and execution chain to understand how the interpreter was launched and whether it originated from a browser, office application, archive utility, or remote access tool.
- Check whether the same host or user generated additional suspicious process, network, or file events around the same time.
- If the payload can be safely decoded in an isolated environment, inspect the decoded content for follow-on execution, credential access, persistence, or download behavior.
False positive analysis
- Administrative automation, packaging workflows, or developer tooling may legitimately pass large encoded blobs to scripting interpreters.
- PowerShell remoting, software deployment frameworks, or internal bootstrap scripts can occasionally use encoded commands; validate the source, user, and expected automation context.
Response and remediation
- Isolate the affected host if the decoded content or surrounding activity indicates malicious execution.
- Terminate the suspicious interpreter process and any spawned child processes.
- Preserve the full command line and related process tree for forensic analysis before making changes on the host.
- Reset or revoke any credentials, tokens, or secrets exposed by the decoded payload or subsequent attacker activity.