Suspicious PowerShell Base64 Decoding

[rule]
description = """
Identifies the execution of PowerShell with suspicious base64 decoding activity. This behavior is often observed during
malware installation leveraging PowerShell.
"""
id = "08fa5da1-81af-413d-a960-f7e489c75cfb"
license = "Elastic License v2"
name = "Suspicious PowerShell Base64 Decoding"
os_list = ["windows"]
version = "1.0.13"

query = '''
api where process.Ext.api.name == "AmsiScanBuffer" and process.parent.executable != null and
  process.name in~ ("powershell.exe")  and
  process.Ext.api.parameters.buffer : "*FromBase64String*" and
  /* suspicious activity along base64 decoding */
  process.Ext.api.parameters.buffer :
                       ("*.downloadstring*", "*.downloadfile*", "*.downloaddata*", "*.WebClient*", "*(iWr *", "* iwr*", "iwr *",
                        "*-bxor*", "*).Content*", "*IEX *", "*iex(*", "*Invoke-Expression", "*Invoke-Expression $*", "*iex;*",
                        "*Start-Process*", "*SeDebugPrivilege*", "*Cryptography.Aes*") and

  not process.Ext.api.parameters.buffer : ("function Get-DecryptedConfig*", "function Unprotect-ConfigFile*") and
  not process.Ext.api.parameters.content_name :
                   ("C:\\WINDOWS\\CCM\\SystemTemp\\*.ps1",
                    "C:\\PowerShell\\AES.ps1",
                    "C:\\sysmgt\\sw\\ADSMonitoring\\modules\\POSAntiVirusHealth\\POSAntiVirusHealth.psm1",
                    "C:\\Packages\\Plugins\\Rapid7.InsightPlatform.InsightAgentWindows\\*\\bin\\shared.psm1",
                    "C:\\sysmgt\\sw\\Monitoring\\PSModule\\POSAntiVirusHealth\\POSAntiVirusHealth.psm1",
                    "C:\\WINDOWS\\_IS\\PostESPconfig\\clienthealth\\uploadDeviceHealth_remediation.ps1",
                    "C:\\Program Files\\*", "C:\\Program Files (x86)\\*",
                    "D:\\*", "E:\\*" ,"F:\\*", "I:\\*", "\\\\*",
                    "C:\\Octopus\\*.ps1",
                    "C:\\Octopus??\\*.ps1",
                    "C:\\*\\Bootstrap.Octopus.FunctionAppenderContext.ps1",
                    "C:\\ProgramData\\HP\\MIK\\RunHPIA.ps1",
                    "C:\\Packages\\Plugins\\*.ps1",
                    "C:\\Packages\\Plugins\\*.psm1",
                    "C:\\temp\\intune-install.ps1",
                    "C:\\temp\\*\\intune-install.ps1",
                    "C:\\mdeanalyzer\\MDEClientAnalyzer\\MDEClientAnalyzer.ps1",
                    "C:\\Users\\*\\scoop\\apps\\scoop\\current\\lib\\autoupdate.ps1",
                    "C:\\WINDOWS\\IMECache\\HealthScripts\\*.ps1",
                    "C:\\sysmgt\\sw\\A\\DSMonitoring\\modules\\POSAntiVirusHealth\\POSAntiVirusHealth.psm1",
                    "C:\\ProgramData\\Microsoft\\Windows Defender Advanced Threat Protection\\DataCollection\\*.ps1",
                    "C:\\Windows\\IMECache\\*\\intune-install.ps1",
                    "C:\\*\\IntuneManagement*\\Extensions\\IntuneAppManagement.psm1",
                    "C:\\SCS\\*\\Scripts\\Get-SCCMInventoryData.ps1",
                    "C:\\ProgramData\\NinjaRMMAgent\\scripting\\customscript_gen*.ps1",
                    "C:\\Tenable\\Tenable.ad\\Tools\\Run_RelayUpdater.ps1",
                    "C:\\Hexnode\\Resources\\*.ps1") and
  not process.parent.executable :
                   ("C:\\Program Files\\Windows Defender Advanced Threat Protection\\SenseIR.exe",
                    "C:\\Program Files\\Octopus Deploy\\Tentacle\\Tentacle.exe",
                    "C:\\Program Files (x86)\\CentraStage\\CagService.exe",
                    "C:\\Program Files (x86)\\Common Files\\VAudio\\Interop.Exe",
                    "C:\\ProgramData\\CentraStage*\\AEMAgent\\AEMAgent.exe",
                    "C:\\Program Files\\Git\\usr\\bin\\sh.exe",
                    "C:\\Windows\\SysWOW64\\msiexec.exe",
                    "C:\\Windows\\CCM\\CcmExec.exe") and
  not (process.Ext.api.parameters.size == 2434 and process.Ext.api.parameters.buffer : "function Load-Assembly*" and process.parent.executable : "C:\\Windows\\Sys*\\cmd.exe") and 
  not process.command_line : ("*JgBjAGgAYwBwAC4AYwBvAG0AIAA2AD*", "*UwBlAHQALQBFAHgAZQBjAHUAdABpAG8AbgBQAG8AbABpAGMAeQAgAC0ARQB4AGUAYwB1A*", "*AQAAANCMnd8BFdERjHoAwE*", "*C:\\Program Files (x86)\\Microsoft Office\\root\\vfs\\SystemX86\\sppc.dll*") and
  not (process.executable : "C:\\Windows\\System32\\wsmprovhost.exe" and process.Ext.api.parameters.buffer : "*Ansible*") and
  not process.executable :
                 ("?:\\Program Files\\*.exe",
                  "?:\\Program Files (x86)\\*.exe",
                  "C:\\CloudEngRinnovoCertificati\\bin\\CloudEngCertificati.exe",
                  "D:\\SF-Deploy\\Console\\Jobs\\ClearNetBootGUID.exe")
'''

min_endpoint_version = "8.16.0"
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0
tree = true

[[optional_actions]]
action = "rollback"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1059"
name = "Command and Scripting Interpreter"
reference = "https://attack.mitre.org/techniques/T1059/"
[[threat.technique.subtechnique]]
id = "T1059.001"
name = "PowerShell"
reference = "https://attack.mitre.org/techniques/T1059/001/"



[threat.tactic]
id = "TA0002"
name = "Execution"
reference = "https://attack.mitre.org/tactics/TA0002/"

[internal]
min_endpoint_version = "8.16.0"