Deobfuscate/Decode Files or Information detection rulesT1140

Detects usage of the "FromBase64String" function in the commandline which is used to decode a base64 encoded string

windows · process_creation

Detects execution of mshta.exe with file types that looks like they do not typically represent HTA (HTML Application) content, such as .png, .jpg, .zip, .pdf, and others, which are often polyglots. MSHTA is a legitimate Windows utility for executing HTML Applications containing VBScript or JScript. Threat actors often abuse this lolbin utility to download and execute malicious scripts disguised as benign files or hosted under misleading extensions to evade detection.

windows · process_creation

Detects a ping command that uses a hex encoded IP address

windows · process_creation

Detects the use of tail to extract bytes at an offset from an image and then decode the base64 value to create a new file with the decoded content. The detected execution is a bash one-liner.

macos · process_creation

Detects command line patterns used by BlackByte ransomware in different operations

windows · process_creation

Detects usage of a base64 encoded "FromBase64String" cmdlet in a process command line

windows · process_creation

Detects suspicious rules that delete or move messages or folders are set on a user's inbox.

azure

Detects execution of "wget" to download a ".zip" or ".rar" files from "temp.sh". As seen used by UNC4841 during their Barracuda ESG zero day exploitation.

linux · process_creation

Detects execution of "wget" to download a "tar" from an IP address that doesn't have a trusted certificate. As seen used by UNC4841 during their Barracuda ESG zero day exploitation.

linux · process_creation

Detects the execution of "openssl" to connect to an IP address. This techniques was used by UNC4841 to exfiltrate SSL certificates and as a C2 channel with named pipes. Investigate commands executed in the temporal vicinity of this command.

linux · process_creation

Detects when a user enables DNS-over-HTTPS. This can be used to hide internet activity or be used to hide the process of exfiltrating data. With this enabled organization will lose visibility into data such as query type, response and originating IP that are used to determine bad actors.

windows · registry_set

Detects suspicious process command line that uses base64 encoded input for execution with a shell

linux · process_creation

Detects the presence of a base64 version of the shebang in the commandline, which could indicate a malicious payload about to be decoded

linux · process_creation

Detects suspicious process command line that starts with a shell that executes something and finally gets piped into another shell

linux · process_creation

Detects when a built-in utility is used to decode and decrypt a payload after a macOS disk image (DMG) is executed. Malware authors may attempt to evade detection and trick users into executing malicious code by encoding and encrypting their payload and placing it in a disk image file. This behavior is consistent with adware or malware families such as Bundlore and Shlayer.

macos · process_creation

Detects potential commandline obfuscation using known escape characters

windows · process_creation

Detects presence of a potentially xor encoded powershell command

windows · process_creation

A General detection for specific decompress commands in PowerShell logs. This could be an adversary decompressing files.

windows · ps_module