data-manipulation/encoding/base64
rule:
meta:
name: decode data using Base64 in .NET
namespace: data-manipulation/encoding/base64
authors:
- michael.hunhoff@mandiant.com
scopes:
static: function
dynamic: call
att&ck:
- Defense Evasion::Deobfuscate/Decode Files or Information [T1140]
mbc:
- Data::Decode Data::Base64 [C0053.001]
features:
- or:
- api: System.Convert::FromBase64String
- api: System.Convert::FromBase64CharArray
- api: System.Convert::TryFromBase64Chars
- api: System.Convert::TryFromBase64String
last edited: 2023-11-24 10:34:28