Glossary
base64 modifier
The base64 and base64wide modifiers match a YARA string after base64 encoding, including when it sits at any alignment in encoded data.
$a = "powershell -nop" base64 finds the string inside base64-encoded data, whatever its position within the encoded block (YARA generates the three possible alignments). base64wide matches the encoded form stored as UTF-16LE. A custom 64-character alphabet can be passed as an argument.
It cannot be combined with nocase, xor or fullword, and short strings produce ambiguous encodings.