Elastic medium stable eql

Encoded Payload Detected via Defend for Containers

This rule detects the execution of potential defense evasion techniques via encoded payloads inside a container. Attackers may use base64 encoding/decoding to obfuscate data, such as command and control traffic or payloads, to evade detection by host- or network-based security controls.

View Source

Detection Logic

process where host.os.type == "linux" and event.type == "start" and event.action == "exec" and (
  (process.name in ("base64", "base64plain", "base64url", "base64mime", "base64pem", "base32", "base16") and process.args like~ "*-*d*") or
  (process.name == "xxd" and process.args like~ ("-*r*", "-*p*")) or
  (process.name == "openssl" and process.args == "enc" and process.args in ("-d", "-base64", "-a")) or
  (process.name like "python*" and (
    (process.args == "base64" and process.args in ("-d", "-u", "-t")) or
    (process.args == "-c" and process.args like "*base64*" and process.args like "*b64decode*")
  )) or
  (process.name like "perl*" and process.args like "*decode_base64*") or
  (process.name like "ruby*" and process.args == "-e" and process.args like "*Base64.decode64*")
) and container.id like "?*"

Field Validations

Loading…

Comments (0)

Loading comments...