Decoded Payload Piped to Interpreter

[rule]
description = """
This rule identifies when a decoded payload is piped to an interpreter. Malware authors may attempt to evade detection
by encoding and obfuscating their payload.
"""
id = "452d6452-a8ec-4cae-9720-567fb44d93b7"
license = "Elastic License v2"
name = "Decoded Payload Piped to Interpreter"
os_list = ["linux"]
version = "1.0.9"

query = '''
sequence by process.parent.entity_id, process.working_directory with maxspan=1s
  [process where event.type == "start" and event.action == "exec" and (
    (
      process.name in ("base64", "basez", "base64plain", "base64url", "base64mime", "base64pem", "basenc", "base32", "base16") and
      process.command_line like~ ("* -d*", "* --decode*")
    ) or
    (
      process.name == "openssl" and
      process.args == "enc" and process.args in ("-d", "-base64", "-a", "-A")
    ) or
    (
      process.name like "python*" and (
        (process.args == "base64" and process.args in ("-d", "-u", "-t")) or
        (process.args == "-c" and process.args like "*base64*" and process.command_line like~ "*b64decode*")
      )
    ) or
    (
      process.name like "perl*" and
      process.command_line like~ "*decode_base64*"
    ) or
    (
      process.name like "ruby*" and
      process.args == "-e" and
      process.command_line like~ "*Base64.decode64*"
    ) or
    (
      process.name like~ "java*" and
      process.command_line like~ "*base64*decode(*"
    ) or
    (
      process.name like~ "lua*" and
      process.command_line like~ ("*mime.decode(*base64*", "*mime.unb64(*")
    ) or
    (
      process.name in ("node", "deno") and
      (
        process.command_line like~ ("*atob(*", "*eval(*") or
        (
          process.command_line like~ "*buffer.from*" and
          process.command_line like~ "*base64*"
        )
      )
    ) or
    (
      process.name == "pwsh" and
      process.command_line like~ (
        "* -e *", "* -en *", "* -enc *", "* -enco *", "* -encod *", "* -encode *", "* -encoded *",
        "* -encodedcommand *", "*frombase64string*"
      )
    ) or
    (
      process.name in ("bash", "dash", "sh", "tcsh", "csh", "zsh", "ksh", "fish", "busybox") and
      process.command_line like~ ("*base64 -d*", "*base64 --decode*")
    )
  ) and
  not (
    process.parent.command_line like "*DAAAAAtAAAAOQAAAF0AAAArAAAAJAAAACAAAABdAAAAXQAAACAAAAAmAAAAJgAAACAAAABbAAAAIAAAACIAAAAkAAAAcwAAAGkAAABnAAAAbgAAAGEAAAB0AAAAdQAAAHIAAABlAAAAIgAAACAAAAAtAAAAZQAAAHEAAAAgAAAAMgAAADAAAAAwAAAAMgAAADAAAAA5AAAAIAAAAF0AAAA7AAAAIAAAAHQAAABoAAAAZQAAAG4AAAA*" or
    process.command_line like "/bin/bash -c base64 -d <<< IwAAAC*" or
    (
      process.parent.executable like "/var/lib/amazon/ssm/i-*/document/orchestration/*_script.sh" and
      process.working_directory == "/usr/bin" and
      process.command_line == "base64 --decode"
    ) or
    (
      process.working_directory like "/var/snap/amazon-ssm-agent/*" and
      process.parent.args like "/var/lib/amazon/ssm/*/document/orchestration/*/_script.sh" and
      process.name == "base64"
    ) or
    process.working_directory in ("/opt/SolarWinds/Agent/bin/Plugins/ADMProbe", "/root/control-center-packaging") or
    process.parent.executable in ("/usr/share/windsurf/windsurf", "/usr/share/cursor/cursor", "/usr/share/devin-desktop/devin-desktop") or
    process.parent.command_line like ("claude", "*__CURSOR_SANDBOX_ENV_RESTORE*") or
    (
      process.command_line like~ ("*eval*1337*SendConductor*", "*eval*KITTY_SSH_KITTEN_DATA_DIR*") and
      process.parent.name in ("sshd", "sshd-session")
    ) or
    process.command_line like "/bin/bash -c base64 -d <<< IwAAACAAAABHAAAAZQAAAHQAAAAgAAAAdAAAAGg*" or
    (
      process.parent.command_line like (
        "/bin/bash -c base64 -d <<< IwAAACAAAABHAAAAZQAAAHQAAAAgAAAAdAAAAGg*",
        "/bin/bash -c base64 -d <<< IwAAACEAAAAvAAAAYgAAAGkAAABuAAAAL*"
      ) and
      process.command_line == "base64 -d"
    ) or
    (process.working_directory like "/home/u.*" and process.parent.command_line like "bash -lc printf %s*") or 
    (process.working_directory == "/opt/Elastic/Endpoint/state/response_actions" and process.command_line == "base64 -d") or
    (process.working_directory == "/home/deploy" and user.name == "deploy" and process.parent.args == "bash")
  )]
  [process where event.type == "start" and event.action == "exec" and process.name like (
    "bash", "dash", "sh", "tcsh", "csh", "zsh", "ksh", "fish",
    "python*", "perl*", "ruby*", "lua*", "php*", "node", "pwsh", "deno"
  ) and process.args_count == 1 and
  process.args like (
    "-bash", "-dash", "-sh", "-tcsh", "-csh", "-zsh", "-ksh", "-fish",
    "bash", "dash", "sh", "tcsh", "csh", "zsh", "ksh", "fish",
    "/bin/bash", "/bin/dash", "/bin/sh", "/bin/tcsh", "/bin/csh",
    "/bin/zsh", "/bin/ksh", "/bin/fish",
    "/usr/bin/bash", "/usr/bin/dash", "/usr/bin/sh", "/usr/bin/tcsh",
    "/usr/bin/csh", "/usr/bin/zsh", "/usr/bin/ksh", "/usr/bin/fish",
    "python*", "/bin/python*", "/usr/bin/python*", "/usr/local/bin/python*",
    "perl*", "/bin/perl*", "/usr/bin/perl*", "/usr/local/bin/perl*",
    "ruby*", "/bin/ruby*", "/usr/bin/ruby*", "/usr/local/bin/ruby*",
    "lua*", "/bin/lua*", "/usr/bin/lua*", "/usr/local/bin/lua*",
    "php*", "/bin/php*", "/usr/bin/php*", "/usr/local/bin/php*",
    "node", "/bin/node", "/usr/bin/node", "/usr/local/bin/node",
    "pwsh", "/bin/pwsh", "/usr/bin/pwsh", "/usr/local/bin/pwsh",
    "deno", "/bin/deno", "/usr/bin/deno", "/usr/local/bin/deno",
    "/dev/fd/*"
  ) and
  not (
    process.parent.command_line in ("bash ./run_tests.sh unit-integration", "/bin/sh /var/lib/dpkg/info/nmap-common.postinst configure") or
    process.command_line == "/usr/bin/perl /usr/bin/shasum -a 256" or
    process.working_directory like (
      "/usr/local/zeek", "/opt/zeek", "/var/lib/docker/overlay2/*/opt/zeek", "/usr/local/zeek_old_install",
      "/var/lib/docker/overlay2/*/usr/local/zeek", "/proc/self/fd/*/usr/local/zeek"
    ) or
    (process.parent.name == "zsh" and process.parent.command_line like "*extendedglob*") or
    (process.name like "python*" and process.parent.name like "python*")
  )]
'''

min_endpoint_version = "7.15.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 1

[[actions]]
action = "kill_process"
field = "process.parent.entity_id"
state = 0

[[actions]]
action = "kill_process"
field = "process.parent.entity_id"
state = 1

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1059"
name = "Command and Scripting Interpreter"
reference = "https://attack.mitre.org/techniques/T1059/"
[[threat.technique.subtechnique]]
id = "T1059.004"
name = "Unix Shell"
reference = "https://attack.mitre.org/techniques/T1059/004/"


[[threat.technique]]
id = "T1204"
name = "User Execution"
reference = "https://attack.mitre.org/techniques/T1204/"
[[threat.technique.subtechnique]]
id = "T1204.002"
name = "Malicious File"
reference = "https://attack.mitre.org/techniques/T1204/002/"



[threat.tactic]
id = "TA0002"
name = "Execution"
reference = "https://attack.mitre.org/tactics/TA0002/"
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1027"
name = "Obfuscated Files or Information"
reference = "https://attack.mitre.org/techniques/T1027/"

[[threat.technique]]
id = "T1140"
name = "Deobfuscate/Decode Files or Information"
reference = "https://attack.mitre.org/techniques/T1140/"


[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"

[internal]
min_endpoint_version = "7.15.0"