base64

Encode or decode file or stdin to/from Base64, to stdout. tldr-pages

GTFOBins file-read 2 Sigma rules name it 1 ATT&CK technique 1 documented command

How base64 is abused

documented by GTFOBins

file-read

--decode

Each abuse is GTFOBins's category and the options and words it uses; the full write-up is on GTFOBins's page for base64.

1 documented command

from GTFOBins, each read by the identifier

file-read unprivileged, with sudo, as SUID

base64 /path/to/input-file | base64 --decode

Identify

Trips 1 Sigma rule: lowDecode Base64 Encoded Text by Daniil Yugoslavskiy, oscd.community

The command the identifier reads trips a Sigma process-creation rule. This command is from GTFOBins, at commit acd524623f9c of 2026-05-27, under the GPL-3.0, with no warranty. Changed: Markdown is shown formatted. The source is in lolbas-gtfobins-commands.json.gz, and the full entry is on GTFOBins’s page for base64. The identifier reads the line that runs base64.

What detects it

Sigma process creation rules

lowDecode Base64 Encoded TextDaniil Yugoslavskiy, oscd.community

lowDecode Base64 Encoded Text -MacOsDaniil Yugoslavskiy, oscd.community

T1027Obfuscated Files or Information

Everyday use

from tldr-pages, CC BY 4.0

Encode a file

base64 path/to/fileIdentify

Wrap encoded output at a specific width (0 disables wrapping)

base64 --wrap 0 path/to/fileIdentify

Decode a file

base64 --decode path/to/fileIdentify

Trips 1 Sigma rule: lowDecode Base64 Encoded Text by Daniil Yugoslavskiy, oscd.community

Of the 3 examples the identifier reads, 1 matches GTFOBins abuse or trips a Sigma process-creation rule.

Options

3 in toybox

Show every option of base64

-dDecode

-iIgnore non-alphabetic characters

-w COLUMNSWrap output at COLUMNS (default 76 or 0 for no wrap)