Base64 — CraftedSignal Threat Feedhttps://feed.craftedsignal.io/tags/base64/Trending threats, MITRE ATT&CK coverage, and detection metadata — refreshed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioWed, 03 Jan 2024 17:00:00 +0000Long Base64 Encoded Command via Scripting Interpreterhttps://feed.craftedsignal.io/briefs/2024-01-03-long-base64-interpreter-cmdline/Wed, 03 Jan 2024 17:00:00 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2024-01-03-long-base64-interpreter-cmdline/Detection of oversized command lines used by Python, PowerShell, Node.js, or Deno interpreters containing base64 decoding or encoded-command patterns, indicating potential evasion and malicious execution.This rule identifies the execution of scripting interpreters (Python, PowerShell, Node.js, and Deno) with unusually long command lines containing base64 encoded payloads. The rule focuses on scenarios where the initial process.command_line field is ignored due to its excessive length, but the complete command line is still available in process.command_line.text. Attackers leverage this technique to evade traditional command-line inspection and execute malicious content across Windows, macOS, and Linux systems. This approach allows attackers to embed and execute code without writing it to disk, making it harder to detect. The rule is designed to detect this behavior, allowing for closer inspection of the executed commands and their intent.

Attack Chain

  1. An attacker gains initial access to a system (e.g., via phishing or exploiting a vulnerability).
  2. The attacker uses PowerShell, Python, Node.js, or Deno to execute commands.
  3. A long, base64-encoded string is crafted, designed to evade detection.
  4. The interpreter is invoked with the encoded string passed as an argument, exceeding typical command-line limits.
  5. The process.command_line field is truncated due to its length, but the full command line is available in process.command_line.text.
  6. The interpreter decodes and executes the payload from the process.command_line.text.
  7. The decoded payload performs malicious actions such as downloading malware, establishing persistence, or exfiltrating data.
  8. The attacker achieves their objective, such as gaining control of the system or stealing sensitive information.

Impact

Successful exploitation can lead to a wide range of malicious activities, including malware installation, data theft, privilege escalation, and system compromise. Due to the defense evasion capabilities, it is difficult to identify and prevent. The impact includes potential data breaches, financial losses, and reputational damage. The rule’s detection helps defenders identify this attack vector and prevent further exploitation of affected systems.

Recommendation

  • Deploy the Sigma rule Detect Long Base64 Encoded Command via Scripting Interpreter to your SIEM to detect this behavior.
  • Investigate any alerts generated by this rule, focusing on the process.command_line.text field to understand the full command being executed.
  • Review parent processes and execution chains of the interpreter to understand the initial attack vector.
  • Implement controls to restrict the execution of scripting interpreters from untrusted sources.
  • Monitor process execution logs for command lines exceeding a certain length threshold.
  • Improve logging coverage to capture the full command line even when it exceeds standard limits.
]]>highadvisorydefense-evasionexecutionscripting-interpreterbase64command-line