NRT Base64 encoded Windows process command-lines

Back


Id	c3e5dbaa-a540-408c-8b36-68bdfb3df088
Rulename	NRT Base64 encoded Windows process command-lines
Description	Identifies instances of a base64 encoded PE file header seen in the process command line parameter.
Severity	Medium
Tactics	Execution DefenseEvasion
Techniques	T1059 T1027 T1140
Required data connectors	SecurityEvents WindowsSecurityEvents
Kind	NRT
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Windows Security Events/Analytic Rules/NRT_base64_encoded_pefile.yaml
Version	1.0.0
Arm template	c3e5dbaa-a540-408c-8b36-68bdfb3df088.json

KQL

SecurityEvent
 | where EventID==4688
 | where isnotempty(CommandLine)
 | where CommandLine contains "TVqQAAMAAAAEAAA"

YAML

description: |
    'Identifies instances of a base64 encoded PE file header seen in the process command line parameter.'
name: NRT Base64 encoded Windows process command-lines
tactics:
- Execution
- DefenseEvasion
status: Available
relevantTechniques:
- T1059
- T1027
- T1140
query: |
  SecurityEvent
   | where EventID==4688
   | where isnotempty(CommandLine)
   | where CommandLine contains "TVqQAAMAAAAEAAA"  
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Windows Security Events/Analytic Rules/NRT_base64_encoded_pefile.yaml
severity: Medium
version: 1.0.0
entityMappings:
- entityType: Account
  fieldMappings:
  - identifier: FullName
    columnName: Account
- entityType: Host
  fieldMappings:
  - identifier: FullName
    columnName: Computer
id: c3e5dbaa-a540-408c-8b36-68bdfb3df088
requiredDataConnectors:
- connectorId: SecurityEvents
  dataTypes:
  - SecurityEvent
- connectorId: WindowsSecurityEvents
  dataTypes:
  - SecurityEvent
kind: NRT

ARM

{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workspace": {
      "type": "String"
    }
  },
  "resources": [
    {
      "id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/c3e5dbaa-a540-408c-8b36-68bdfb3df088')]",
      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/c3e5dbaa-a540-408c-8b36-68bdfb3df088')]",
      "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules",
      "kind": "Nrt",
      "apiVersion": "2022-11-01",
      "properties": {
        "displayName": "NRT Base64 encoded Windows process command-lines",
        "description": "'Identifies instances of a base64 encoded PE file header seen in the process command line parameter.'\n",
        "severity": "Medium",
        "enabled": true,
        "query": "SecurityEvent\n | where EventID==4688\n | where isnotempty(CommandLine)\n | where CommandLine contains \"TVqQAAMAAAAEAAA\"\n",
        "suppressionDuration": "PT1H",
        "suppressionEnabled": false,
        "tactics": [
          "Execution",
          "DefenseEvasion"
        ],
        "techniques": [
          "T1059",
          "T1027",
          "T1140"
        ],
        "alertRuleTemplateName": "c3e5dbaa-a540-408c-8b36-68bdfb3df088",
        "customDetails": null,
        "entityMappings": [
          {
            "entityType": "Account",
            "fieldMappings": [
              {
                "identifier": "FullName",
                "columnName": "Account"
              }
            ]
          },
          {
            "entityType": "Host",
            "fieldMappings": [
              {
                "identifier": "FullName",
                "columnName": "Computer"
              }
            ]
          }
        ],
        "status": "Available",
        "OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Windows Security Events/Analytic Rules/NRT_base64_encoded_pefile.yaml",
        "templateVersion": "1.0.0"
      }
    }
  ]
}