Security finds my base64 "suspicious"

I wrote a one liner to query my EC2 instances in AWS. I wanted to run it on multiple servers (in multiple AWS accounts) so I decided to run:

ssh servername 'oneliner'

and then do that for each server/account. Problem is, the one liner has single quotes (and they have to be single quotes), so I base64 encoded the command line and then ran:

ssh servername 'echo "aGVsbG8gci9saW51eAo=" | base64 --decode | bash'

And did that for each server. That's not the real base64, but you get the point.

I arrive at my desk this morning to find an email from the security team. Microsoft Defender on those servers flagged my command as "suspicious". Microsoft snitched on me! Security wanted to know if I had indeed run that command and if so why, what was I doing, etc. What I wanted to tell them was you can decode base64 just as well as I can ya idiot. You even see how to do it in the report you got. And if you can see the command then you can see that what I was doing was regular old Linux commands doing regular old aws cli queries. Pound sand! I chose other words though...

I am handy with a Linux command line and I'll be damned if I'm gonna apologize for doing regular Linux things.

https://redd.it/1us02f9
@r_linux