NRT Base64 Encoded Windows Process Command-lines

Back


Id	c3e5dbaa-a540-408c-8b36-68bdfb3df088
Rulename	NRT Base64 Encoded Windows Process Command-lines
Description	This detection identifies instances of a base64 encoded PE file header seen in the process command line parameter.
Severity	Medium
Tactics	Execution DefenseEvasion
Techniques	T1059 T1027 T1140
Required data connectors	SecurityEvents WindowsSecurityEvents
Kind	NRT
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Windows Security Events/Analytic Rules/NRT_base64_encoded_pefile.yaml
Version	1.0.2
Arm template	c3e5dbaa-a540-408c-8b36-68bdfb3df088.json

KQL

SecurityEvent
 | where EventID == 4688
 | where isnotempty(CommandLine)
 | where CommandLine contains "TVqQAAMAAAAEAAA"
 | extend HostName = tostring(split(Computer, '.', 0)[0]), DnsDomain = tostring(strcat_array(array_slice(split(Computer, '.'), 1, -1), '.'))

YAML

version: 1.0.2
query: |
  SecurityEvent
   | where EventID == 4688
   | where isnotempty(CommandLine)
   | where CommandLine contains "TVqQAAMAAAAEAAA"
   | extend HostName = tostring(split(Computer, '.', 0)[0]), DnsDomain = tostring(strcat_array(array_slice(split(Computer, '.'), 1, -1), '.'))  
kind: NRT
id: c3e5dbaa-a540-408c-8b36-68bdfb3df088
relevantTechniques:
- T1059
- T1027
- T1140
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Windows Security Events/Analytic Rules/NRT_base64_encoded_pefile.yaml
requiredDataConnectors:
- dataTypes:
  - SecurityEvent
  connectorId: SecurityEvents
- dataTypes:
  - SecurityEvent
  connectorId: WindowsSecurityEvents
description: |
    'This detection identifies instances of a base64 encoded PE file header seen in the process command line parameter.'
entityMappings:
- entityType: Account
  fieldMappings:
  - columnName: SubjectAccount
    identifier: FullName
  - columnName: SubjectUserName
    identifier: Name
  - columnName: SubjectDomainName
    identifier: NTDomain
- entityType: Host
  fieldMappings:
  - columnName: Computer
    identifier: FullName
  - columnName: HostName
    identifier: HostName
  - columnName: DnsDomain
    identifier: DnsDomain
status: Available
name: NRT Base64 Encoded Windows Process Command-lines
severity: Medium
tactics:
- Execution
- DefenseEvasion

ARM

{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workspace": {
      "type": "String"
    }
  },
  "resources": [
    {
      "apiVersion": "2024-01-01-preview",
      "id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/c3e5dbaa-a540-408c-8b36-68bdfb3df088')]",
      "kind": "NRT",
      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/c3e5dbaa-a540-408c-8b36-68bdfb3df088')]",
      "properties": {
        "alertRuleTemplateName": "c3e5dbaa-a540-408c-8b36-68bdfb3df088",
        "customDetails": null,
        "description": "'This detection identifies instances of a base64 encoded PE file header seen in the process command line parameter.'\n",
        "displayName": "NRT Base64 Encoded Windows Process Command-lines",
        "enabled": true,
        "entityMappings": [
          {
            "entityType": "Account",
            "fieldMappings": [
              {
                "columnName": "SubjectAccount",
                "identifier": "FullName"
              },
              {
                "columnName": "SubjectUserName",
                "identifier": "Name"
              },
              {
                "columnName": "SubjectDomainName",
                "identifier": "NTDomain"
              }
            ]
          },
          {
            "entityType": "Host",
            "fieldMappings": [
              {
                "columnName": "Computer",
                "identifier": "FullName"
              },
              {
                "columnName": "HostName",
                "identifier": "HostName"
              },
              {
                "columnName": "DnsDomain",
                "identifier": "DnsDomain"
              }
            ]
          }
        ],
        "OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Windows Security Events/Analytic Rules/NRT_base64_encoded_pefile.yaml",
        "query": "SecurityEvent\n | where EventID == 4688\n | where isnotempty(CommandLine)\n | where CommandLine contains \"TVqQAAMAAAAEAAA\"\n | extend HostName = tostring(split(Computer, '.', 0)[0]), DnsDomain = tostring(strcat_array(array_slice(split(Computer, '.'), 1, -1), '.'))\n",
        "severity": "Medium",
        "status": "Available",
        "subTechniques": [],
        "suppressionDuration": "PT1H",
        "suppressionEnabled": false,
        "tactics": [
          "DefenseEvasion",
          "Execution"
        ],
        "techniques": [
          "T1027",
          "T1059",
          "T1140"
        ],
        "templateVersion": "1.0.2"
      },
      "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules"
    }
  ]
}