Dangerous Execution Chain — exec/eval Wrapping Decoder
This detects a specific pattern used to smuggle and run malicious code: a program decodes hidden data (like base64) or fetches something from the network, then immediately feeds that result into a command that executes it as code. This combination is a classic way malware hides its real payload until the last moment.
How the attack works
An attacker embeds a payload in an encoded or remote form so it doesn't appear as plain, readable code. At runtime, the program decodes the payload (for example with base64 decoding or deserialization) or retrieves it from a network location. The decoded or fetched result is passed directly into a function that executes arbitrary code, such as exec() or eval(), without ever being written to disk or reviewed. This lets the real malicious logic stay hidden from static code review and only appear in memory at execution time.
Netzilo detection
Netzilo can block this behaviour when it is observed.
- Signature ID
- 33c4d5e6-f7a8-4b90-1234-c5d6e7f8a9b0
- Severity
- Critical
Why it matters
If this pattern runs successfully, the attacker gains arbitrary code execution in the context of the application or agent, which can lead to data theft, further payload delivery, or full compromise of the host.
What you can do
- →Ban or tightly restrict use of exec()/eval() and similar dynamic execution functions on untrusted or decoded/fetched data.
- →Require that any decoded or downloaded content be logged and reviewed before execution, not executed inline.
- →Run code that must deserialize or fetch external content in a sandboxed, least-privilege environment.
- →Audit codebases and AI agent tool chains for patterns combining decoding/network functions directly inside exec() or eval() calls.
Known benign look-alikes
- Legitimate serialization/deserialization in sandboxed environments