Suspicious Python Zlib and Base64 One-liner Execution

Swachchhanda Shrawan Poudel (Nextron Systems)

Detects Python command line execution using zlib decompression and base64 with decode functions, often used for executing obfuscated payloads. Threat actors may use this technique to execute malicious encoded code in a single line, which can be indicative of attempts to bypass security measures or deliver payloads in a stealthy manner.

2025-05-28 00:00:00

None

2e7d8c3e-2b6a-4e8c-9e7d-1b2a3c4d5e6f

attack.execution attack.t1059.006 attack.defense-evasion attack.t1027.010

Nextron Sigma feed only (private)