This simple rule searches for the Base64 alphabet. Files matching this rule have likely implemented base64.
I ran this rule against the files contained in /bin
on my system. Analyzing a handful of matches revealed that all of them did in fact implement the base64 algorithm.
rule base64_alphabet
{
meta:
description = "Base64 alphabet"
strings:
$ = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" ascii wide
condition:
all of them
}
Pingback: Week 04 – 2022 – This Week In 4n6