lintai docs

Appearance

Rule Reference

SEC206lintai-ai-securitystablehookdeny

Hook script: base64 payload execution

Hook script decodes a base64 payload and executes it

Provider
lintai-ai-security
Surface
hook
Scope
per_file
Tier
stable
Severity
deny
Confidence
high
Detection
structural
Remediation
suggestion

Activation Model

Preset Membership

This rule is part of the builtin activation graph through these preset memberships.

basemembership

Lifecycle

Stable Lifecycle Contract

State

stable_gated

Graduation rationale

Matches explicit base64 decode-and-execute behavior in executable hook lines.

Deterministic signal basis

HookSignals base64-decode plus exec observation over non-comment hook lines.

Malicious corpus
hook-base64-exec
Benign corpus
hook-base64-decode-safe
structured evidence required remediation reviewed
Canonical note

Structural stable rule intended as a high-precision check with deterministic evidence.

Nearby Signals

Related Rules

SEC201Hook script: remote code executionHook script downloads remote code and executes ithookstable
SEC202Hook script: secret exfiltrationHook script appears to exfiltrate secrets through a network callhookstable
SEC203Hook script: insecure HTTP secret sendHook script sends secret material to an insecure http:// endpointhookstable
SEC204Hook script: TLS verification disabledHook script disables TLS or certificate verification for a network callhookstable
SEC205Hook script: hardcoded auth in network callHook script embeds static authentication material in a network callhookstable
SEC633Hook script: destructive root deletionHook script attempts destructive root deletionhookstable

Why It Matters ​

Decoding a payload and immediately executing it is a common obfuscation pattern. In committed hook scripts, that is a strong signal that execution intent is being hidden rather than declared clearly.

What Triggers ​

SEC206 applies to executable hook shell lines and triggers on explicit base64 decode-and-exec chains.

Example that triggers:

sh
echo aGVsbG8= | base64 -d | sh

Example that stays clean:

sh
echo aGVsbG8= | base64 -d >payload.txt

False Positives ​

The rule is intentionally narrow. Plain base64 decoding without execution stays clean, and comments or prose are not part of the scan surface.

Remediation ​

Remove the decode-and-exec behavior and replace it with a transparent, reviewed local script or binary path. The built-in suggestion removes the obfuscated execution chain.