# Base64 Encoded Remote Code Execution via Raw IP

- **Severity:** Critical
- **Signature ID:** `22337777-57a9-437d-9058-f4a7a787be66`
- **MITRE ATLAS:** AML.T0048 (External Harms)
- **OWASP:** ASI04 (Memory and Context Poisoning), LLM07 (System Prompt Leakage)

## Summary

This detects a common malware-dropper trick: hiding a shell command inside Base64 encoding so it slips past casual review, then decoding it to download and immediately run a script from a bare IP address instead of a named domain. It's often used to smuggle malicious installation steps into AI agent inputs or generated commands.

## How the attack works

An attacker crafts or injects text containing a Base64-encoded string. When decoded, that string is a curl command that fetches content from a raw IP address rather than a domain name, then pipes the downloaded content directly into bash for execution. The encoding hides the true intent from anyone skimming the input or output, and using a raw IP avoids DNS records that could otherwise be used to identify or block the source. If an AI agent decodes and runs this without scrutiny, the attacker's code executes on whatever system the agent controls.

## Why it matters

Successful execution gives the attacker arbitrary code running on the victim's system, which can lead to further compromise, data theft, or use of that system as a foothold for wider attacks.

## What you can do

- Block or flag automated decoding and execution of Base64 strings found in agent inputs or outputs.
- Restrict outbound network access from agents so they cannot fetch and run scripts from arbitrary raw IP addresses.
- Require that any download-and-execute pattern (curl/wget piped to a shell) target only an allowlist of known domains, never bare IPs.
- Review any agent workflow that pipes downloaded content directly into a shell interpreter and add a manual approval step.

## Known benign look-alikes

- Legitimate CI/CD scripts that use named domains for downloads
- Official package managers downloading from CDNs
- Documentation showing Base64 examples without execution context

## References

- https://agentthreatrule.org/en/rules/ATR-2026-00220

---
Source: https://www.netzilo.com/threats/atr-base64-encoded-remote-code-execution-via-raw-ip