Detects base64-encoded content within GenAI prompts or model responses using the security_ai ML integration. When one or more strings in the GenAI input or output appear base64-encoded, the rule flags the payload as potential obfuscated content that could be used for prompt injection, data exfiltration, or indirect prompt-injection attacks against LLMs. Strings that match known credential formats (e.g., AWS access keys, API keys, private-key headers) are explicitly excluded from this alert and are instead routed to the dedicated GenAI Prompt Contains Leaked Credential rule at higher severity. The rule aggregates base64 strings from security_ai.encoding.input_messages.strings and security_ai.encoding.output_messages.strings across cloud-service logs (AWS Bedrock, OpenAI ChatGPT Enterprise) and analyzes the decoded plaintext for shell commands, scripts, or other payloads. It uses two credential-pattern suppressions to minimize false positives due to benign encoded data. If a decoded payload triggers suspicion, investigators should review the associated conversation context, the involved user or application identifiers, and whether similar encoded content appeared previously. The rule is MITRE ATT&CK mapped to T1027 (Obfuscated/Compressed Files or Information) with MITRE ATLAS AML.T0068 (LLM Prompt Obfuscation) and AML.TA0007 (Defense Evasion). Setup requires the security_ai Fleet integration. The rule runs on a 10-minute interval, with alerts based on the Esql query and a risk score of 47 (severity: medium). References include OWASP Top 10 for LLM applications and Elastic security guidance, and it provides an Investigation Guide for triage and remediation steps.