Suspicious Windows Script Base64 Encoding

[rule]
description = """
Detects the execution of a Windows script with base64 encoding along with other suspicious features like execution and
download.
"""
id = "0c23f47e-2f47-48fb-b00c-201368a9975c"
license = "Elastic License v2"
name = "Suspicious Windows Script Base64 Encoding"
os_list = ["windows"]
version = "1.0.6"

query = '''
api where process.Ext.api.name == "AmsiScanBuffer" and process.executable != null and
 process.name in~ ("wscript.exe", "mshta.exe", "msxsl.exe") and
  (process.Ext.api.parameters.buffer : "*bin.base64*" and
   process.Ext.api.parameters.buffer : ("*.Run(*", "*.ShellExecute(*", "*.responseBody*", "*XMLHTTP*", "*WinHttp*", "*.responseText*", "*http:*", "https:*")) and

  not process.Ext.api.parameters.content_name : ("?:\\Program Files (x86)\\*", "?:\\Program Files\\*", "C:\\Windows\\IMECache\\*\\RunHidden.vbs") and
  not process.parent.executable :
                     ("?:\\Program Files\\HP\\*.exe",
                      "?:\\Program Files (x86)\\Tanium\\Tanium Client\\TaniumClient.exe",
                      "?:\\Program Files\\Bentley\\*.exe",
                      "?:\\Program Files\\System Center Operations Manager\\Gateway\\MonitoringHost.exe",
                      "?:\\Program Files\\Microsoft Monitoring Agent\\Agent\\MonitoringHost.exe",
                      "?:\\Program Files\\Common Files\\Bentley Shared\\CONNECTION Client\\Bentley.Connect.Client.exe",
                      "?:\\Program Files (x86)\\Bentley\\*.exe",
                      "?:\\Program Files\\Bentley\\*.exe",
                      "?:\\Windows\\LSDeployment\\RemoteDeployment*.exe")
'''

min_endpoint_version = "8.16.0"
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0
tree = true

[[optional_actions]]
action = "rollback"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1059"
name = "Command and Scripting Interpreter"
reference = "https://attack.mitre.org/techniques/T1059/"
[[threat.technique.subtechnique]]
id = "T1059.005"
name = "Visual Basic"
reference = "https://attack.mitre.org/techniques/T1059/005/"

[[threat.technique.subtechnique]]
id = "T1059.007"
name = "JavaScript"
reference = "https://attack.mitre.org/techniques/T1059/007/"



[threat.tactic]
id = "TA0002"
name = "Execution"
reference = "https://attack.mitre.org/tactics/TA0002/"

[internal]
min_endpoint_version = "8.16.0"