NRT Process executed from binary hidden in Base64 encoded file

Status: available
Severity: medium
Source: github.com/Azure/Azure-Sentinel

Encoding malicious software is a technique used to obfuscate files from detection. The first CommandLine component is looking for Python decoding base64. The second CommandLine component is looking for Bash/sh command line base64 decoding. The third one is looking for Ruby decoding base64.

MITRE ATT&CK coverage

Tactic	Techniques
Execution	`T1059` Command and Scripting Interpreter
Stealth	`T1027` Obfuscated Files or Information `T1140` Deobfuscate/Decode Files or Information

Telemetry coverage

Provider	Record / event type
Security-Auditing	Event ID 4688: A new process has been created.

Rule body

id: 7ad4c32b-d0d2-411c-a0e8-b557afa12fce
name: NRT Process executed from binary hidden in Base64 encoded file
description: |
  'Encoding malicious software is a technique used to obfuscate files from detection.
  The first CommandLine component is looking for Python decoding base64.
  The second CommandLine component is looking for Bash/sh command line base64 decoding.
  The third one is looking for Ruby decoding base64.'
severity: Medium
status: Available
requiredDataConnectors:
  - connectorId: SecurityEvents
    dataTypes:
      - SecurityEvent
  - connectorId: WindowsSecurityEvents
    dataTypes:
      - SecurityEvent
tactics:
  - Execution
  - DefenseEvasion
relevantTechniques:
  - T1059
  - T1027
  - T1140
query: |
  SecurityEvent
  | where EventID==4688
  | where isnotempty(CommandLine)
  | project TimeGenerated, Computer, AccountName = SubjectUserName, AccountNTDomain = SubjectDomainName, FileName = Process, CommandLine, ParentProcessName, SubjectAccount
  | extend HostName = tostring(split(Computer, ".")[0]), DomainIndex = toint(indexof(Computer, '.'))
  | extend HostNameDomain = iff(DomainIndex != -1, substring(Computer, DomainIndex + 1), Computer)
  | where CommandLine contains ".decode('base64')"
          or CommandLine contains "base64 --decode"
          or CommandLine contains ".decode64("
entityMappings:
  - entityType: Account
    fieldMappings:
      - identifier: FullName
        columnName: SubjectAccount
      - identifier: Name
        columnName: AccountName
      - identifier: NTDomain
        columnName: AccountNTDomain
  - entityType: Host
    fieldMappings:
      - identifier: FullName
        columnName: Computer
      - identifier: HostName
        columnName: HostName
      - identifier: DnsDomain
        columnName: HostNameDomain
version: 1.0.2
kind: NRT

Stages and Predicates

Stage 1: `source`

SecurityEvent

Stage 2: `where`

| where EventID==4688

Stage 3: `where`

| where isnotempty(CommandLine)

Stage 4: `project`

| project TimeGenerated, Computer, AccountName = SubjectUserName, AccountNTDomain = SubjectDomainName, FileName = Process, CommandLine, ParentProcessName, SubjectAccount

Stage 5: `extend`

| extend HostName = tostring(split(Computer, ".")[0]), DomainIndex = toint(indexof(Computer, '.'))

Stage 6: `extend`

| extend HostNameDomain = iff(DomainIndex != -1, substring(Computer, DomainIndex + 1), Computer)

HostNameDomain =

ifDomainIndex != -1substring(Computer, (DomainIndex + 1))

elseComputer

Stage 7: `where`

| where CommandLine contains ".decode('base64')"
        or CommandLine contains "base64 --decode"
        or CommandLine contains ".decode64("

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`CommandLine`	contains	`.decode('base64')` corpus 2 (kusto 2) `.decode64(` corpus 2 (kusto 2) `base64 --decode` corpus 4 (elastic 2, kusto 2)	`field:"CommandLine" kind:contains`
`CommandLine`	is_not_null	(no value, null check)	`field:"CommandLine" kind:is_not_null`
`EventID`	eq	`4688` corpus 317 (splunk 283, kusto 33, elastic 1)	`field:"EventID" kind:eq value:"4688"`

Output fields

These fields are emitted when the rule matches.

Field	Source
`AccountNTDomain`	`project`
`AccountName`	`project`
`CommandLine`	`project`
`Computer`	`project`
`FileName`	`project`
`ParentProcessName`	`project`
`SubjectAccount`	`project`
`TimeGenerated`	`project`
`DomainIndex`	`extend`
`HostName`	`extend`
`HostNameDomain`	`extend`

NRT Process executed from binary hidden in Base64 encoded file

MITRE ATT&CK coverage

Telemetry coverage

Rule body

Stages and Predicates

Stage 1: source

Stage 2: where

Stage 3: where

Stage 4: project

Stage 5: extend

Stage 6: extend

Stage 7: where