base64decode.yml

name: base64decode
id: fc2a1c3c-3251-418d-b411-7e62303e2cb3
version: 2
creation_date: '2024-01-10'
modification_date: '2026-09-22'
author: Splunk Threat Research Team
description: Content based conversion of UTF8/UTF16 based base64 encoding. Not a full implementation, but good enough for context without additional app installation.
definition: 'eval b64x_split=split($b64in$,"") | lookup local=t char_conversion_matrix base64char as b64x_split OUTPUT base64bin as b64x_bin | eval b64x_join=mvjoin(b64x_bin,"") | rex field=b64x_join "(?<b64x_by8>.{8})" max_match=0 | lookup local=t char_conversion_matrix bin as b64x_by8 output ascii as b64x_out | eval $b64in$_decode=mvjoin(b64x_out,"") | fields - b64x_* | eval $b64in$_decode = replace(replace($b64in$_decode,":NUL:",""),":SPACE:"," ") | rex field=$b64in$_decode mode=sed "s/\x00//g"'
arguments:
    - b64in