mirror of
https://github.com/splunk/security_content
synced 2026-06-08 17:32:49 +00:00
Eric McGinnis
11 lines
845 B
YAML
11 lines
845 B
YAML
name: base64decode
|
|
id: fc2a1c3c-3251-418d-b411-7e62303e2cb3
|
|
version: 1
|
|
creation_date: '2024-01-10'
|
|
modification_date: '2026-05-13'
|
|
author: Splunk Threat Research Team
|
|
description: Content based conversion of UTF8/UTF16 based base64 encoding. Not a full implementation, but good enough for context without additional app installation.
|
|
definition: 'eval b64x_split=split($b64in$,"") | lookup char_conversion_matrix base64char as b64x_split OUTPUT base64bin as b64x_bin | eval b64x_join=mvjoin(b64x_bin,"") | rex field=b64x_join "(?<b64x_by8>.{8})" max_match=0 | lookup char_conversion_matrix bin as b64x_by8 output ascii as b64x_out | eval $b64in$_decode=mvjoin(b64x_out,"") | fields - b64x_* | eval $b64in$_decode = replace(replace($b64in$_decode,":NUL:",""),":SPACE:"," ") | rex field=$b64in$_decode mode=sed "s/\x00//g"'
|
|
arguments:
|
|
- b64in
|