mirror of
https://github.com/splunk/security_content
synced 2026-06-08 17:32:49 +00:00
Bhavin Patel
13 lines
699 B
YAML
13 lines
699 B
YAML
arguments:
|
|
- b64in
|
|
definition: 'eval b64x_split=split($b64in$,"")
|
|
| lookup char_conversion_matrix base64char as b64x_split OUTPUT base64bin as b64x_bin
|
|
| eval b64x_join=mvjoin(b64x_bin,"")
|
|
| rex field=b64x_join "(?<b64x_by8>.{8})" max_match=0
|
|
| lookup char_conversion_matrix bin as b64x_by8 output ascii as b64x_out
|
|
| eval $b64in$_decode=mvjoin(b64x_out,"")
|
|
| fields - b64x_*
|
|
| eval $b64in$_decode = replace(replace($b64in$_decode,":NUL:",""),":SPACE:"," ")
|
|
| rex field=$b64in$_decode mode=sed "s/\x00//g"'
|
|
description: Content based conversion of UTF8/UTF16 based base64 encoding. Not a full implementation, but good enough for context without additional app installation.
|
|
name: base64decode |