Base64 or Xxd Decode Argument Evasion

[rule]
description = """
This rule detects when a process executes the base64 or xxd command with arguments that are atypical for decoding data,
but are capable of decoding data. This may indicate an attempt to evade detection while decoding data.
"""
id = "789f8a41-00cb-40cb-b41f-c2e1611b1245"
license = "Elastic License v2"
name = "Base64 or Xxd Decode Argument Evasion"
os_list = ["linux"]
version = "1.0.3"

query = '''
process where event.type == "start" and event.action == "exec" and (
  (process.name == "base64" and process.args : "*-*d* " and not process.args in (
    "-d", "--decode", "--encode", "-rand", "-di"
  )) or
  (process.name == "xxd" and process.args : "-p* " and process.args : "-r* " and not process.args in ("-p", "-r"))
)
'''

min_endpoint_version = "7.15.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[actions]]
action = "kill_process"
field = "process.parent.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1059"
name = "Command and Scripting Interpreter"
reference = "https://attack.mitre.org/techniques/T1059/"
[[threat.technique.subtechnique]]
id = "T1059.004"
name = "Unix Shell"
reference = "https://attack.mitre.org/techniques/T1059/004/"


[[threat.technique]]
id = "T1204"
name = "User Execution"
reference = "https://attack.mitre.org/techniques/T1204/"
[[threat.technique.subtechnique]]
id = "T1204.002"
name = "Malicious File"
reference = "https://attack.mitre.org/techniques/T1204/002/"



[threat.tactic]
id = "TA0002"
name = "Execution"
reference = "https://attack.mitre.org/tactics/TA0002/"
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1027"
name = "Obfuscated Files or Information"
reference = "https://attack.mitre.org/techniques/T1027/"

[[threat.technique]]
id = "T1140"
name = "Deobfuscate/Decode Files or Information"
reference = "https://attack.mitre.org/techniques/T1140/"


[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"

[internal]
min_endpoint_version = "7.15.0"