NRT Process executed from binary hidden in Base64 encoded file

Back


Id	7ad4c32b-d0d2-411c-a0e8-b557afa12fce
Rulename	NRT Process executed from binary hidden in Base64 encoded file
Description	Encoding malicious software is a technique used to obfuscate files from detection. The first CommandLine component is looking for Python decoding base64. The second CommandLine component is looking for Bash/sh command line base64 decoding. The third one is looking for Ruby decoding base64.
Severity	Medium
Tactics	Execution DefenseEvasion
Techniques	T1059 T1027 T1140
Required data connectors	SecurityEvents WindowsSecurityEvents
Kind	NRT
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Windows Security Events/Analytic Rules/NRT_execute_base64_decodedpayload.yaml
Version	1.0.2
Arm template	7ad4c32b-d0d2-411c-a0e8-b557afa12fce.json

KQL

SecurityEvent
| where EventID==4688
| where isnotempty(CommandLine)
| project TimeGenerated, Computer, AccountName = SubjectUserName, AccountNTDomain = SubjectDomainName, FileName = Process, CommandLine, ParentProcessName, SubjectAccount
| extend HostName = tostring(split(Computer, ".")[0]), DomainIndex = toint(indexof(Computer, '.'))
| extend HostNameDomain = iff(DomainIndex != -1, substring(Computer, DomainIndex + 1), Computer)
| where CommandLine contains ".decode('base64')"
        or CommandLine contains "base64 --decode"
        or CommandLine contains ".decode64("

YAML

entityMappings:
- entityType: Account
  fieldMappings:
  - identifier: FullName
    columnName: SubjectAccount
  - identifier: Name
    columnName: AccountName
  - identifier: NTDomain
    columnName: AccountNTDomain
- entityType: Host
  fieldMappings:
  - identifier: FullName
    columnName: Computer
  - identifier: HostName
    columnName: HostName
  - identifier: DnsDomain
    columnName: HostNameDomain
requiredDataConnectors:
- dataTypes:
  - SecurityEvent
  connectorId: SecurityEvents
- dataTypes:
  - SecurityEvent
  connectorId: WindowsSecurityEvents
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Windows Security Events/Analytic Rules/NRT_execute_base64_decodedpayload.yaml
relevantTechniques:
- T1059
- T1027
- T1140
status: Available
version: 1.0.2
severity: Medium
kind: NRT
id: 7ad4c32b-d0d2-411c-a0e8-b557afa12fce
query: |
  SecurityEvent
  | where EventID==4688
  | where isnotempty(CommandLine)
  | project TimeGenerated, Computer, AccountName = SubjectUserName, AccountNTDomain = SubjectDomainName, FileName = Process, CommandLine, ParentProcessName, SubjectAccount
  | extend HostName = tostring(split(Computer, ".")[0]), DomainIndex = toint(indexof(Computer, '.'))
  | extend HostNameDomain = iff(DomainIndex != -1, substring(Computer, DomainIndex + 1), Computer)
  | where CommandLine contains ".decode('base64')"
          or CommandLine contains "base64 --decode"
          or CommandLine contains ".decode64("  
description: |
  'Encoding malicious software is a technique used to obfuscate files from detection.
  The first CommandLine component is looking for Python decoding base64.
  The second CommandLine component is looking for Bash/sh command line base64 decoding.
  The third one is looking for Ruby decoding base64.'  
name: NRT Process executed from binary hidden in Base64 encoded file
tactics:
- Execution
- DefenseEvasion

ARM