ClawHub Backdoor Multi-Layer Encoding Decode Chain in Python
Detects the execution of Python interpreters with command-line arguments that utilize common obfuscation and decoding techniques. The rule identifies a combination of Base64 decoding, codec decoding, ROT13/ROT47 rotation, and hexadecimal string conversion, which are frequently used to hide malicious scripts or payloads from static analysis.
Splunk (SPL)
