rule:
  meta:
    name: reference Base58 string
    namespace: data-manipulation/encoding/base58
    authors:
      - william.ballenthin@mandiant.com
    description: Similar to Base64, but modified to avoid both non-alphanumeric characters (+ and /) and letters that might look ambiguous when printed (0, I, O, and l). Base58 is used to represent bitcoin addresses.
    scopes:
      static: file
      dynamic: file
    att&ck:
      - Defense Evasion::Obfuscated Files or Information [T1027]
    mbc:
      - Data::Encode Data [C0026]
    references:
      - https://en.wikipedia.org/wiki/Binary-to-text_encoding#Base58
  features:
    - string: /123456789ABCDEFGHJKLMNPQRSTUVWXYZabcdefghijkmnopqrstuvwxyz/