Encoded or Obfuscated Command Execution

How the attack works

An attacker (or a script run on their behalf) encodes a command or payload, often with base64, to avoid it appearing as readable text in logs or process listings. The encoded blob is then decoded at execution time and piped directly into a shell interpreter, or passed to Python's eval or exec functions. Because the actual command only exists in decoded form for a brief moment during execution, it is harder to spot with plain string matching. This technique is typically one step in a larger chain, such as downloading a second-stage payload or running attacker-supplied instructions after gaining some initial access.

Netzilo detection

Why it matters

If missed, this lets an attacker run arbitrary commands or code while evading log-based or keyword-based detection, making it harder to reconstruct what actually executed on a system.

What you can do

• →Review any process execution where decoded/piped input goes straight into a shell or into eval/exec, especially outside known build or deployment jobs.
• →Maintain an allowlist of scripts and toolchains that legitimately use base64 encoding (e.g. build pipelines) so deviations stand out.
• →Log decoded command content, not just the encoded form, where feasible, so investigators can see what actually ran.
• →Restrict or monitor use of eval/exec in production Python environments, and require code review for any new use of these functions.

Known benign look-alikes

• Legitimate build scripts using base64 encoding for binary data
• Development toolchains that compile and execute code snippets

References

• https://attack.mitre.org/techniques/T1027/
• https://arxiv.org/abs/2403.04783

Related threats