diff --git a/tests/from_base64-01/README.md b/tests/from_base64-01/README.md
new file mode 100644
index 000000000..d1024db4c
--- /dev/null
+++ b/tests/from_base64-01/README.md
@@ -0,0 +1 @@
+from_base64 transform tests
diff --git a/tests/from_base64-01/test.rules b/tests/from_base64-01/test.rules
new file mode 100644
index 000000000..172f296cb
--- /dev/null
+++ b/tests/from_base64-01/test.rules
@@ -0,0 +1,5 @@
+# input pcap contains a query to http://home.regit.org/?arg=dGhpc2lzYXRlc3QK
+# "dGhpc2lzYXRlc3QK" is "thisisatest"
+alert http any any -> any any (msg:"from_base64: offset #1"; http.uri; content:"/?arg=dGhpc2lzYXRlc3QK"; from_base64: offset 6 ; content:"thisisatest"; sid:1; rev:1;)
+alert http any any -> any any (msg:"from_base64: offset #2"; http.uri; content:"/?arg=dGhpc2lzYXRlc3QK"; from_base64: offset 10 ; content:"sisatest"; sid:2; rev:1;)
+alert http any any -> any any (msg:"from_base64: bytes, offset #1"; http.uri; content:"/?arg=dGhpc2lzYXRlc3QK"; from_base64: bytes 6, offset 6 ; content:"this"; sid:3; rev:1;)
diff --git a/tests/from_base64-01/test.yaml b/tests/from_base64-01/test.yaml
new file mode 100644
index 000000000..0d2394787
--- /dev/null
+++ b/tests/from_base64-01/test.yaml
@@ -0,0 +1,24 @@
+requires:
+  min-version: 8
+
+pcap: ../base64/input.pcap
+
+args:
+  - -k none
+
+checks:
+  - filter:
+      count: 1
+      match:
+         event_type: alert
+         alert.signature_id: 1
+  - filter:
+      count: 1
+      match:
+         event_type: alert
+         alert.signature_id: 2
+  - filter:
+      count: 1
+      match:
+         event_type: alert
+         alert.signature_id: 3