Suricata

Thinking about something like:

file.data; from_base64:strict,set_error; content:"BASE64_ECODE_BUF";

Not entirely sure what the buffer should be set to.

It could be used to make sure base64 at an expected location is valid, so it wouldn't match if it decoded correctly.

file.data; from_base64:strict,set_error; bsize:0;

Would also need to see how to express this, as the bsize here is useless.