Decoded Payload Piped to Interpreter
Description
This rule identifies when a decoded payload is piped to an interpreter. Malware authors may attempt to evade detection by encoding and obfuscating their payload.
Query · eql
sequence by process.parent.entity_id, process.working_directory with maxspan=1s
[process where event.type == "start" and event.action == "exec" and (
(
process.name in ("base64", "basez", "base64plain", "base64url", "base64mime", "base64pem", "basenc", "base32", "base16") and
process.command_line like~ ("* -d*", "* --decode*")
) or
(
process.name == "openssl" and
process.args == "enc" and process.args in ("-d", "-base64", "-a", "-A")
) or
(
process.name like "python*" and (
(process.args == "base64" and process.args in ("-d", "-u", "-t")) or
(process.args == "-c" and process.args like "*base64*" and process.command_line like~ "*b64decode*")
)
) or
(
process.name like "perl*" and
process.command_line like~ "*decode_base64*"
) or
(
process.name like "ruby*" and
process.args == "-e" and
process.command_line like~ "*Base64.decode64*"
) or
(
process.name like~ "java*" and
process.command_line like~ "*base64*decode(*"
) or
(
process.name like~ "lua*" and
process.command_line like~ ("*mime.decode(*base64*", "*mime.unb64(*")
) or
(
process.name in ("node", "deno") and
(
process.command_line like~ ("*atob(*", "*eval(*") or
(
process.command_line like~ "*buffer.from*" and
process.command_line like~ "*base64*"
)
)
) or
(
process.name == "pwsh" and
process.command_line like~ (
"* -e *", "* -en *", "* -enc *", "* -enco *", "* -encod *", "* -encode *", "* -encoded *",
"* -encodedcommand *", "*frombase64string*"
)
) or
(
process.name in ("bash", "dash", "sh", "tcsh", "csh", "zsh", "ksh", "fish", "busybox") and
process.command_line like~ ("*base64 -d*", "*base64 --decode*")
)
) and
not (
process.parent.command_line like "*DAAAAAtAAAAOQAAAF0AAAArAAAAJAAAACAAAABdAAAAXQAAACAAAAAmAAAAJgAAACAAAABbAAAAIAAAACIAAAAkAAAAcwAAAGkAAABnAAAAbgAAAGEAAAB0AAAAdQAAAHIAAABlAAAAIgAAACAAAAAtAAAAZQAAAHEAAAAgAAAAMgAAADAAAAAwAAAAMgAAADAAAAA5AAAAIAAAAF0AAAA7AAAAIAAAAHQAAABoAAAAZQAAAG4AAAA*" or
process.command_line like "/bin/bash -c base64 -d <<< IwAAAC*" or
(
process.parent.executable like "/var/lib/amazon/ssm/i-*/document/orchestration/*_script.sh" and
process.working_directory == "/usr/bin" and
process.command_line == "base64 --decode"
) or
(
process.working_directory like "/var/snap/amazon-ssm-agent/*" and
process.parent.args like "/var/lib/amazon/ssm/*/document/orchestration/*/_script.sh" and
process.name == "base64"
) or
process.working_directory in ("/opt/SolarWinds/Agent/bin/Plugins/ADMProbe", "/root/control-center-packaging") or
process.parent.executable in ("/usr/share/windsurf/windsurf", "/usr/share/cursor/cursor", "/usr/share/devin-desktop/devin-desktop") or
process.parent.command_line like ("claude", "*__CURSOR_SANDBOX_ENV_RESTORE*") or
(
process.command_line like~ ("*eval*1337*SendConductor*", "*eval*KITTY_SSH_KITTEN_DATA_DIR*") and
process.parent.name in ("sshd", "sshd-session")
) or
process.command_line like "/bin/bash -c base64 -d <<< IwAAACAAAABHAAAAZQAAAHQAAAAgAAAAdAAAAGg*" or
(
process.parent.command_line like (
"/bin/bash -c base64 -d <<< IwAAACAAAABHAAAAZQAAAHQAAAAgAAAAdAAAAGg*",
"/bin/bash -c base64 -d <<< IwAAACEAAAAvAAAAYgAAAGkAAABuAAAAL*"
) and
process.command_line == "base64 -d"
) or
(process.working_directory like "/home/u.*" and process.parent.command_line like "bash -lc printf %s*") or
(process.working_directory == "/opt/Elastic/Endpoint/state/response_actions" and process.command_line == "base64 -d") or
(process.working_directory == "/home/deploy" and user.name == "deploy" and process.parent.args == "bash") or
process.entry_leader.executable == "/usr/sbin/qemu-ga"
)]
[process where event.type == "start" and event.action == "exec" and process.name like (
"bash", "dash", "sh", "tcsh", "csh", "zsh", "ksh", "fish",
"python*", "perl*", "ruby*", "lua*", "php*", "node", "pwsh", "deno"
) and process.args_count == 1 and
process.args like (
"-bash", "-dash", "-sh", "-tcsh", "-csh", "-zsh", "-ksh", "-fish",
"bash", "dash", "sh", "tcsh", "csh", "zsh", "ksh", "fish",
"/bin/bash", "/bin/dash", "/bin/sh", "/bin/tcsh", "/bin/csh",
"/bin/zsh", "/bin/ksh", "/bin/fish",
"/usr/bin/bash", "/usr/bin/dash", "/usr/bin/sh", "/usr/bin/tcsh",
"/usr/bin/csh", "/usr/bin/zsh", "/usr/bin/ksh", "/usr/bin/fish",
"python*", "/bin/python*", "/usr/bin/python*", "/usr/local/bin/python*",
"perl*", "/bin/perl*", "/usr/bin/perl*", "/usr/local/bin/perl*",
"ruby*", "/bin/ruby*", "/usr/bin/ruby*", "/usr/local/bin/ruby*",
"lua*", "/bin/lua*", "/usr/bin/lua*", "/usr/local/bin/lua*",
"php*", "/bin/php*", "/usr/bin/php*", "/usr/local/bin/php*",
"node", "/bin/node", "/usr/bin/node", "/usr/local/bin/node",
"pwsh", "/bin/pwsh", "/usr/bin/pwsh", "/usr/local/bin/pwsh",
"deno", "/bin/deno", "/usr/bin/deno", "/usr/local/bin/deno",
"/dev/fd/*"
) and
not (
process.parent.command_line in ("bash ./run_tests.sh unit-integration", "/bin/sh /var/lib/dpkg/info/nmap-common.postinst configure") or
process.command_line == "/usr/bin/perl /usr/bin/shasum -a 256" or
process.working_directory like (
"/usr/local/zeek", "/opt/zeek", "/var/lib/docker/overlay2/*/opt/zeek", "/usr/local/zeek_old_install",
"/var/lib/docker/overlay2/*/usr/local/zeek", "/proc/self/fd/*/usr/local/zeek"
) or
(process.parent.name == "zsh" and process.parent.command_line like "*extendedglob*") or
(process.name like "python*" and process.parent.name like "python*")
)]