from logs-endpoint.events.process-*
| keep @timestamp, host.os.type, event.type, event.action, process.name, process.args, process.command_line, agent.id, host.name
| where @timestamp > now() - 1 hours
| where host.os.type == "linux" and event.type == "start" and event.action == "exec" and (
  (process.name in ("base64", "base64plain", "base64url", "base64mime", "base64pem", "base32", "base16") and process.command_line like "*-*d*") or
  (process.name == "openssl" and process.args == "enc" and process.args in ("-d", "-base64", "-a")) or
  (process.name like "python*" and
    (process.args == "base64" and process.args in ("-d", "-u", "-t")) or
    (process.args == "-c" and process.command_line like "*base64*" and process.command_line like "*b64decode*")
  ) or
  (process.name like "perl*" and process.command_line like "*decode_base64*") or
  (process.name like "ruby*" and process.args == "-e" and process.command_line like "*Base64.decode64*")
)
| stats cc = count(), agent_count = count_distinct(agent.id), host.name = VALUES(host.name), agent.id = VALUES(agent.id) by process.name, process.command_line
| where agent_count == 1 and cc < 15
| sort cc asc
| limit 100