Encoded or indirect command execution
A command uses a recognized decode-and-run or inline execution pattern.
Why it is risky
Section titled “Why it is risky”Encoding and indirect execution can conceal what a command will do from ordinary review. Hidden content may download additional code or access secrets.
Example
Section titled “Example”A setup step asks an agent to decode a supplied string and feed the result directly to an interpreter, without reviewing the decoded script.
This is a fictional example, not an event from a customer.
What Omnodex Detects
Section titled “What Omnodex Detects”The rule recognizes selected Base64 pipelines and Python or Perl inline execution forms, in execution and staged content. Some matching inline code is not encoded.
| Rule ID | Event category | Tier | Base severity |
|---|---|---|---|
RULE_THREAT_ENCODED_PAYLOAD | threat_command | Community | HIGH |
Base severity is the rule default. A finding involving content saved for later execution may have a lower severity. Your loaded rule version and event details determine the finding you see.
What to check next
Section titled “What to check next”Inspect decoded content as data in a controlled environment before deciding whether execution is appropriate. Verify the source and permissions requested.
False positives
Section titled “False positives”Legitimate inline scripts, generated build steps, and authorized encoding tests can match. Encoding by itself is not malicious.
False negatives
Section titled “False negatives”Other encodings, alternative interpreters, multiline syntax, or payloads executed inside a separate unseen program can be missed.
Technical details
Section titled “Technical details”The rule recognizes command text rather than decoding and analyzing every payload. Staged matches generally have lower severity than execution matches.
A finding describes a pattern in captured activity. Review the original call, its result, and the task context before concluding that harm occurred. Absence of a finding does not establish that an operation is safe.