Base64encodePEFile

Description

Finding base64 encoded PE files header seen in the command line parameters. Tags: #fileLess #powershell.

Query · kql

DeviceProcessEvents
| where Timestamp > ago(7d)
| where ProcessCommandLine contains "TVqQAAMAAAAEAAA"
| top 1000 by Timestamp
Raw source Base64encodePEFile · KQL
Esc
Published by Azure/Azure-Sentinel ↗, licensed under MIT ↗. Reproduced here unmodified. 
id: 1174ae5b-8ce9-4321-a4e2-99e5f016beed
name: Base64encodePEFile
description: |
  Finding base64 encoded PE files header seen in the command line parameters.
  Tags: #fileLess  #powershell.
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - DeviceProcessEvents
query: |
  DeviceProcessEvents
  | where Timestamp > ago(7d)
  | where ProcessCommandLine contains "TVqQAAMAAAAEAAA"
  | top 1000 by Timestamp

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.