Base64 encoded Windows process command-lines (Normalized Process Events)

Severity: medium
Time window: 1d
Group by: ActingProcessName, ActorUsername, CommandLine, Dvc, EventProduct, EventVendor, Process
Author: Yuval Naor
Source: github.com/Azure/Azure-Sentinel

Identifies instances of a base64 encoded PE file header seen in the process command line parameter. To use this analytics rule, make sure you have deployed the ASIM normalization parsers

MITRE ATT&CK coverage

Tactic	Techniques
Execution	`T1059` Command and Scripting Interpreter
Stealth	`T1027` Obfuscated Files or Information `T1140` Deobfuscate/Decode Files or Information

Telemetry coverage

Provider	Record / event type
Sysmon	Event ID 1: Process creation
Sysmon	Event ID 5: Process terminated
Security-Auditing	Event ID 4688: A new process has been created.
Security-Auditing	Event ID 4689: A process has exited.

Rule body

id: f8b3c49c-4087-499b-920f-0dcfaff0cbca
name: Base64 encoded Windows process command-lines (Normalized Process Events)
description: |
  'Identifies instances of a base64 encoded PE file header seen in the process command line parameter.
  To use this analytics rule, make sure you have deployed the [ASIM normalization parsers](https://aka.ms/ASimProcessEvent)'
severity: Medium
requiredDataConnectors: []
queryFrequency: 1d
queryPeriod: 1d
triggerOperator: gt
triggerThreshold: 0
tactics:
  - Execution
  - DefenseEvasion
relevantTechniques:
  - T1059
  - T1027
  - T1140
tags:
  - Id: ca67c83e-7fff-4127-a3e3-1af66d6d4cad
    version: 1.0.0
  - Schema: ASIMProcessEvent
    SchemaVersion: 0.1.0

query: |
  imProcessCreate
  | where CommandLine contains "TVqQAAMAAAAEAAA"
  | where isnotempty(Process)
  | summarize StartTime = min(TimeGenerated), EndTime = max(TimeGenerated), count() by Dvc, ActorUsername, Process, CommandLine, ActingProcessName, EventVendor, EventProduct
  | extend AccountName = tostring(split(ActorUsername, @'\')[1]), AccountNTDomain = tostring(split(ActorUsername, @'\')[0])
  | extend HostName = tostring(split(Dvc, ".")[0]), DomainIndex = toint(indexof(Dvc, '.'))
  | extend HostNameDomain = iff(DomainIndex != -1, substring(Dvc, DomainIndex + 1), Dvc)
  | project-away DomainIndex
entityMappings:
  - entityType: Account
    fieldMappings:
      - identifier: FullName
        columnName: ActorUsername
      - identifier: Name
        columnName: AccountName
      - identifier: NTDomain
        columnName: AccountNTDomain
  - entityType: Host
    fieldMappings:
      - identifier: FullName
        columnName: Dvc
      - identifier: HostName
        columnName: HostName
      - identifier: DnsDomain
        columnName: HostNameDomain
version: 1.1.4
kind: Scheduled
metadata:
    source:
        kind: Community
    author:
        name: Yuval Naor
    support:
        tier: Community
    categories:
        domains: [ "Security - Threat Protection" ]

Stages and Predicates

Stage 1: `source`

imProcessCreate

Stage 2: `where`

| where CommandLine contains "TVqQAAMAAAAEAAA"

Stage 3: `where`

| where isnotempty(Process)

Stage 4: `summarize`

| summarize StartTime = min(TimeGenerated), EndTime = max(TimeGenerated), count() by Dvc, ActorUsername, Process, CommandLine, ActingProcessName, EventVendor, EventProduct

Stage 5: `extend` (3 consecutive steps)

| extend AccountName = tostring(split(ActorUsername, @'\')[1]), AccountNTDomain = tostring(split(ActorUsername, @'\')[0])
| extend HostName = tostring(split(Dvc, ".")[0]), DomainIndex = toint(indexof(Dvc, '.'))
| extend HostNameDomain = iff(DomainIndex != -1, substring(Dvc, DomainIndex + 1), Dvc)

Stage 6: `project-away`

| project-away DomainIndex

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`CommandLine`	contains	`TVqQAAMAAAAEAAA` corpus 3 (kusto 3)	`field:"CommandLine" kind:contains value:"TVqQAAMAAAAEAAA"`
`Process`	is_not_null	(no value, null check)	`field:"Process" kind:is_not_null`

Output fields

These fields are emitted when the rule matches.

Field	Source
`ActingProcessName`	`summarize`
`ActorUsername`	`summarize`
`CommandLine`	`summarize`
`Dvc`	`summarize`
`EndTime`	`summarize`
`EventProduct`	`summarize`
`EventVendor`	`summarize`
`Process`	`summarize`
`StartTime`	`summarize`
`AccountNTDomain`	`extend`
`AccountName`	`extend`
`HostName`	`extend`
`HostNameDomain`	`extend`

Base64 encoded Windows process command-lines (Normalized Process Events)

MITRE ATT&CK coverage

Telemetry coverage

Rule body

Stages and Predicates

Stage 1: source

Stage 2: where

Stage 3: where

Stage 4: summarize

Stage 5: extend (3 consecutive steps)

Stage 6: project-away