Base64 Encoded Payload Decoded and Executed

Darshan Thummar@Mighty

•updated Jun 11, 2026•0•0•5

This rule detects HTTP traffic where the URI contains the string "FromBase64String" (case-insensitive). This string is often associated with PowerShell or .NET code that decodes a Base64 encoded string, which can then be executed. This technique is commonly used by attackers for defense evasion to obfuscate malicious payloads.