Linux Base64 Encoded Shebang In CLI — Detection Rule

Detects the presence of a base64 version of the shebang in the commandline, which could indicate a malicious payload about to be decoded

Read the full analysis on IntelFusions