This simple rule searches for the Base64 alphabet. Files matching this rule have likely implemented base64.

I ran this rule against the files contained in /bin on my system. Analyzing a handful of matches revealed that all of them did in fact implement the base64 algorithm.

rule base64_alphabet
{
	meta:
		description = "Base64 alphabet"

	strings:
		$ = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" ascii wide

	condition:
		all of them
}

YARA Rules Index