{
  "summary": "The IDS/IPS engine now supports Suricata's base64_decode/base64_data keyword pair - rules that match content against base64-decoded payloads (a common technique in real feeds like URLhaus, for obfuscated PowerShell/webshell/dropper content hidden in form fields or headers) previously parsed but were silently never evaluated; they now match. The decoder is lenient like Suricata's own (keeps the valid prefix, stops at the first invalid byte, rather than discarding the whole decode on the first bad character)."
}