Nishang Reverse TCP Shell in Base64 (Normalized Process Events)

id: 3a8e307b-5037-4182-a4e2-e76d99cecab8
name: Nishang Reverse TCP Shell in Base64 (Normalized Process Events)
description: |
  'Looks for Base64-encoded commands associated with the Nishang reverse TCP shell.
  Ref: https://github.com/samratashok/nishang/blob/master/Shells/Invoke-PowerShellTcp.ps1'
requiredDataConnectors: []
tactics:
  - Exfiltration
relevantTechniques:
  - T1011
query: |
  imProcessCreate
  | where Process has_any ("powershell.exe","powershell_ise.exe") and CommandLine contains "-e" 
  | mvexpand SS = split(CommandLine, " ") 
  | where SS matches regex "[A-Za-z0-9+/]{50,}[=]{0,2}" 
  | extend DecodeString = base64_decode_tostring(tostring(SS)) 
  | extend FinalString = replace("\\0", "", DecodeString) 
  | where FinalString has "tcpclient" and FinalString contains "$" and (FinalString contains "invoke" or FinalString contains "iex") 
  | extend timestamp = TimeGenerated, AccountCustomEntity = User, HostCustomEntity = Dvc

entityMappings:
  - entityType: Account
    fieldMappings:
      - identifier: FullName
        columnName: AccountCustomEntity
  - entityType: Host
    fieldMappings:
      - identifier: FullName
        columnName: HostCustomEntity