NRT Process executed from binary hidden in Base64 encoded file

Back


Id	7ad4c32b-d0d2-411c-a0e8-b557afa12fce
Rulename	NRT Process executed from binary hidden in Base64 encoded file
Description	Encoding malicious software is a technique used to obfuscate files from detection. The first CommandLine component is looking for Python decoding base64. The second CommandLine component is looking for Bash/sh command line base64 decoding. The third one is looking for Ruby decoding base64.
Severity	Medium
Tactics	Execution DefenseEvasion
Techniques	T1059 T1027 T1140
Required data connectors	SecurityEvents WindowsSecurityEvents
Kind	NRT
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Windows Security Events/Analytic Rules/NRT_execute_base64_decodedpayload.yaml
Version	1.0.2
Arm template	7ad4c32b-d0d2-411c-a0e8-b557afa12fce.json

KQL

SecurityEvent
| where EventID==4688
| where isnotempty(CommandLine)
| project TimeGenerated, Computer, AccountName = SubjectUserName, AccountNTDomain = SubjectDomainName, FileName = Process, CommandLine, ParentProcessName, SubjectAccount
| extend HostName = tostring(split(Computer, ".")[0]), DomainIndex = toint(indexof(Computer, '.'))
| extend HostNameDomain = iff(DomainIndex != -1, substring(Computer, DomainIndex + 1), Computer)
| where CommandLine contains ".decode('base64')"
        or CommandLine contains "base64 --decode"
        or CommandLine contains ".decode64("

YAML

description: |
  'Encoding malicious software is a technique used to obfuscate files from detection.
  The first CommandLine component is looking for Python decoding base64.
  The second CommandLine component is looking for Bash/sh command line base64 decoding.
  The third one is looking for Ruby decoding base64.'  
kind: NRT
tactics:
- Execution
- DefenseEvasion
requiredDataConnectors:
- connectorId: SecurityEvents
  dataTypes:
  - SecurityEvent
- connectorId: WindowsSecurityEvents
  dataTypes:
  - SecurityEvent
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Windows Security Events/Analytic Rules/NRT_execute_base64_decodedpayload.yaml
severity: Medium
name: NRT Process executed from binary hidden in Base64 encoded file
query: |
  SecurityEvent
  | where EventID==4688
  | where isnotempty(CommandLine)
  | project TimeGenerated, Computer, AccountName = SubjectUserName, AccountNTDomain = SubjectDomainName, FileName = Process, CommandLine, ParentProcessName, SubjectAccount
  | extend HostName = tostring(split(Computer, ".")[0]), DomainIndex = toint(indexof(Computer, '.'))
  | extend HostNameDomain = iff(DomainIndex != -1, substring(Computer, DomainIndex + 1), Computer)
  | where CommandLine contains ".decode('base64')"
          or CommandLine contains "base64 --decode"
          or CommandLine contains ".decode64("  
relevantTechniques:
- T1059
- T1027
- T1140
id: 7ad4c32b-d0d2-411c-a0e8-b557afa12fce
status: Available
version: 1.0.2
entityMappings:
- entityType: Account
  fieldMappings:
  - columnName: SubjectAccount
    identifier: FullName
  - columnName: AccountName
    identifier: Name
  - columnName: AccountNTDomain
    identifier: NTDomain
- entityType: Host
  fieldMappings:
  - columnName: Computer
    identifier: FullName
  - columnName: HostName
    identifier: HostName
  - columnName: HostNameDomain
    identifier: DnsDomain

ARM