Skip to content

[New] Long Base64 Encoded Command via Scripting Interpreter#5891

Open
Samirbous wants to merge 2 commits intomainfrom
long_cmd
Open

[New] Long Base64 Encoded Command via Scripting Interpreter#5891
Samirbous wants to merge 2 commits intomainfrom
long_cmd

Conversation

@Samirbous
Copy link
Copy Markdown
Contributor

@Samirbous Samirbous commented Mar 27, 2026

Identifies oversized command lines used by Python, PowerShell, Node.js, or Deno that contain base64 decoding or encoded-command patterns. Adversaries may embed long inline encoded payloads in scripting interpreters to evade inspection and execute malicious content across Windows, macOS, and Linux systems.

image

@Samirbous
[New] Long Base64 Encoded Command via Scripting Interpreter
4b5f3b9 
Identifies oversized command lines used by Python, PowerShell, Node.js, or Deno that contain base64 decoding or encoded-command patterns. Adversaries may embed long inline encoded payloads in scripting interpreters to evade inspection and execute malicious content across Windows, macOS, and Linux systems.
@Samirbous Samirbous self-assigned this Mar 27, 2026
@Samirbous Samirbous added Rule: New Proposal for new rule Domain: Endpoint labels Mar 27, 2026
@github-actions
Copy link
Copy Markdown
Contributor

github-actions bot commented Mar 27, 2026

Rule: New - Guidelines

These guidelines serve as a reminder set of considerations when proposing a new rule.

Documentation and Context

  • Detailed description of the rule.
  • List any new fields required in ECS/data sources.
  • Link related issues or PRs.
  • Include references.

Rule Metadata Checks

  • creation_date matches the date of creation PR initially merged.
  • min_stack_version should support the widest stack versions.
  • name and description should be descriptive and not include typos.
  • query should be inclusive, not overly exclusive, considering performance for diverse environments. Non ecs fields should be added to non-ecs-schema.json if not available in an integration.
  • min_stack_comments and min_stack_version should be included if the rule is only compatible starting from a specific stack version.
  • index pattern should be neither too specific nor too vague, ensuring it accurately matches the relevant data stream (e.g., use logs-endpoint.process-* for process data).
  • integration should align with the index. If the integration is newly introduced, ensure the manifest, schemas, and new_rule.yaml template are updated.
  • setup should include the necessary steps to configure the integration.
  • note should include any additional information (e.g. Triage and analysis investigation guides, timeline templates).
  • tags should be relevant to the threat and align/added to the EXPECTED_RULE_TAGS in the definitions.py file.
  • threat, techniques, and subtechniques should map to ATT&CK always if possible.

New BBR Rules

  • building_block_type should be included if the rule is a building block and the rule should be located in the rules_building_block folder.
  • bypass_bbr_timing should be included if adding custom lookback timing to the rule.

Testing and Validation

  • Provide evidence of testing and detecting the expected threat.
  • Check for existence of coverage to prevent duplication.

@tradebot-elastic
Copy link
Copy Markdown

tradebot-elastic commented Mar 27, 2026 •
edited
Loading

⛔️ Test failed

Results
  • ❌ Long Base64 Encoded Command via Scripting Interpreter (esql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta

Aegrah
Aegrah reviewed Mar 27, 2026
View reviewed changes
rules/cross-platform/defense_evasion_long_base64_encoded_interpreter_command_line.toml Outdated
FROM logs-endpoint.events.process-* METADATA _id, _index, _version, _ignored
| MV_EXPAND _ignored
| WHERE _ignored == "process.command_line"
| WHERE host.os.type in ("linux", "macos", "windows") and event.category == "process" and event.type == "start" and event.action != "fork"
Copy link
Copy Markdown
Contributor

@Aegrah Aegrah Mar 27, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Excluding fork here will result in FNs, because of aggregated event actions for linux and macos e.g. ["exec", "fork", "end"] would be excluded.

Copy link
Copy Markdown
Contributor Author

@Samirbous Samirbous Mar 27, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

its not even evaluated since its an array, I will remove it.

rules/cross-platform/defense_evasion_long_base64_encoded_interpreter_command_line.toml
| WHERE _ignored == "process.command_line"
| WHERE host.os.type in ("linux", "macos", "windows") and event.category == "process" and event.type == "start" and event.action != "fork"
| EVAL command_line = TO_LOWER(process.command_line.text), pname = TO_LOWER(process.name)
| WHERE
Copy link
Copy Markdown
Contributor

@Aegrah Aegrah Mar 27, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Might be good to add lua, php, ruby, perl, java, openssl, and common shells with decoding args

Copy link
Copy Markdown
Contributor Author

@Samirbous Samirbous Mar 27, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

may add those as a tuning if no perf/timeout issues (length + ingored fiels), let's test with 3 processes.

rules/cross-platform/defense_evasion_long_base64_encoded_interpreter_command_line.toml
id = "T1059.001"
name = "PowerShell"
reference = "https://attack.mitre.org/techniques/T1059/001/"

Copy link
Copy Markdown
Contributor

@Aegrah Aegrah Mar 27, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

good to add unix shell + lua here if you increase scope based on previous comment

Copy link
Copy Markdown
Contributor Author

@Samirbous Samirbous Mar 27, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

#5891 (comment)

DefSecSentinel
DefSecSentinel reviewed Mar 27, 2026
View reviewed changes
rules/cross-platform/defense_evasion_long_base64_encoded_interpreter_command_line.toml Outdated
FROM logs-endpoint.events.process-* METADATA _id, _index, _version, _ignored
| MV_EXPAND _ignored
| WHERE _ignored == "process.command_line"
| WHERE host.os.type in ("linux", "macos", "windows") and event.category == "process" and event.type == "start" and event.action != "fork"
Copy link
Copy Markdown
Contributor

@DefSecSentinel DefSecSentinel Mar 27, 2026 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

+1 to Aegrah's comment. An allowlist approach like event.action in ("exec", "exec_event", "start", "ProcessRollup2", "executed", "process_started") would be more consistent with the other cross-platform rules (e.g., the companion endpoint rule and the GitHub Actions runner rule in #5892 both use this pattern).

Copy link
Copy Markdown
Contributor Author

@Samirbous Samirbous Mar 27, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

#5891 (comment)

@tradebot-elastic
Copy link
Copy Markdown

tradebot-elastic commented Mar 27, 2026 •
edited
Loading

⛔️ Test failed

Results
  • ❌ Long Base64 Encoded Command via Scripting Interpreter (esql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta

@DefSecSentinel DefSecSentinel self-requested a review April 1, 2026 14:34
DefSecSentinel
DefSecSentinel approved these changes Apr 1, 2026
View reviewed changes
Copy link
Copy Markdown
Contributor

@DefSecSentinel DefSecSentinel left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Appreciate the response. Looks good.

terrancedejesus
terrancedejesus reviewed Apr 1, 2026
View reviewed changes
rules/cross-platform/defense_evasion_long_base64_encoded_interpreter_command_line.toml
)
| EVAL Esql.length_cmdline = LENGTH(command_line)
| WHERE Esql.length_cmdline >= 4000
| KEEP
Copy link
Copy Markdown
Contributor

@terrancedejesus terrancedejesus Apr 1, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Could use | KEEP *

terrancedejesus
terrancedejesus approved these changes Apr 1, 2026
View reviewed changes
Copy link
Copy Markdown
Contributor

@terrancedejesus terrancedejesus left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Maybe a complimentary rule using https://www.elastic.co/docs/reference/query-languages/esql/functions-operators/string-functions/from_base64 and then regex for HTTP URIs. Just a thought.

Mikaayenson
Mikaayenson approved these changes Apr 2, 2026
View reviewed changes
Copy link
Copy Markdown
Contributor

@Mikaayenson Mikaayenson left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

fwiw, I tested the 4k count based on normal command_line size and it makes sense

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@Aegrah Aegrah Aegrah left review comments

@Mikaayenson Mikaayenson Mikaayenson approved these changes

@DefSecSentinel DefSecSentinel DefSecSentinel approved these changes

@terrancedejesus terrancedejesus terrancedejesus approved these changes

@w0rk3r w0rk3r Awaiting requested review from w0rk3r

Assignees

@Samirbous Samirbous

Labels

backport: auto Domain: Endpoint Rule: New Proposal for new rule

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

6 participants

@Samirbous @tradebot-elastic @Mikaayenson @DefSecSentinel @Aegrah @terrancedejesus