Base64 encoding represents data with a printable-character sequence. In investigations, it matters because an attacker can place encoded commands in web-query parameters or PowerShell command lines, making harmful activity less immediately readable while still leaving detectable patterns in logs. section 4.2.1 section 7.1.4
Treat a long, unusual parameter as a lead rather than proof. In web access events, a cluster of requests to a PHP file inside an upload directory, combined with long query strings containing URL-encoded Base64 characters, warrants decoding and correlation with the requested file, timing, and HTTP status. section 4.2.1
Use a repeatable decoding workflow:
- Locate suspicious requests or processes, such as upload-directory PHP requests or PowerShell launched with -enc. section 4.2.1 section 7.1.4
- Extract the candidate encoded value and normalize URL-encoded characters before decoding web-query data. section 4.2.1
- Decode the value with an event-store function, CyberChef, or a local Python or shell script when public upload is inappropriate. section 4.2.1 section 7.1.4
- Interpret the decoded result alongside host and network evidence; decoded commands can expose downloads, permission changes, shell access, or external connections. section 4.2.1 section 7.1.4
- Search PHP content for base64_decode together with exec when looking for potentially tampered web-shell-like files. section 4.5
Listing 4.9 Decoding Base64-encoded web requests
sourcetype = access_combined AND
/project-plan.php/i
| replace("HTTP\/1\.1", with="", field=path, as=path_only)
| regex(".*[iIdD]=(?<encoded>.*)", field=path_only) #1
| replace("%3D", with="=", field=encoded, as=encoded) #2
| replace("%2B", with="+", field=encoded, as=encoded) #3
| decoded := base64Decode(encoded) #4
| table([date,decoded])
| sort(field=date, order=asc) #5
This query extracts an encoded request parameter, restores URL-encoded characters, applies base64Decode, and orders the decoded commands by time. section 4.2.1
Encoded web-shell commands
Requests to project-plan.php carry encoded values that decode to commands including whoami, download attempts using wget or curl, checks for nc, and execution of a downloaded file. The sequence turns an opaque query string into evidence of interactive web-shell activity. section 4.2.1
Encoded PowerShell command
A PowerShell process connecting to a Dropbox address uses -enc to pass a Base64-encoded command. Decoding exposes behavior that includes modifying security-related settings and constructing web requests with headers and an authorization bearer token. section 7.1.4
