sequence by host.id, process.parent.entity_id with maxspan=3s
  [process where host.os.type == "linux" and event.type == "start" and event.action == "exec" and (
    (process.name in ("base64", "base64plain", "base64url", "base64mime", "base64pem", "base32", "base16") and process.command_line like~ "*-*d*") or
    (process.name == "openssl" and process.args == "enc" and process.args in ("-d", "-base64", "-a")) or
    (process.name like "python*" and
    (process.args == "base64" and process.args in ("-d", "-u", "-t")) or
    (process.args == "-c" and process.args like "*base64*" and process.command_line like~ "*b64decode*")
    ) or
    (process.name like "perl*" and process.command_line like~ "*decode_base64*") or
    (process.name like "ruby*" and process.args == "-e" and process.command_line like~ "*Base64.decode64*")
  )]
 [process where host.os.type == "linux" and event.type == "start" and event.action == "exec" and process.name like~ (
    "bash", "dash", "sh", "tcsh", "csh", "zsh", "ksh", "fish", "python*", "perl*", "ruby*", "lua*", "php*"
 )]