Long Base64 Encoded Command via Scripting Interpreter

  1[metadata]
  2creation_date = "2026/03/27"
  3integration = ["endpoint"]
  4maturity = "production"
  5updated_date = "2026/10/06"
  6
  7[rule]
  8author = ["Elastic"]
  9description = """
 10Identifies oversized command lines used by Python, PowerShell, Node.js, or Deno that contain base64 decoding or
 11encoded-command patterns. Adversaries may embed long inline encoded payloads in scripting interpreters to evade
 12inspection and execute malicious content across Windows, macOS, and Linux systems.
 13"""
 14from = "now-9m"
 15language = "esql"
 16license = "Elastic License v2"
 17name = "Long Base64 Encoded Command via Scripting Interpreter"
 18note = """## Triage and analysis
 19
 20### Investigating Long Base64 Encoded Command via Scripting Interpreter
 21
 22This rule detects process start events where the original `process.command_line` field was ignored at index time due to
 23its size, but the full command line remains available in `process.command_line.text`. Attackers commonly use very long
 24base64-encoded inline commands with interpreters such as Python, PowerShell, Node.js, and Deno to conceal payloads and
 25avoid straightforward command-line inspection.
 26
 27### Possible investigation steps
 28
 29- Review `process.command_line.text` to determine whether the encoded content includes shell commands, scripts, URLs, or embedded payloads.
 30- Inspect the parent process and execution chain to understand how the interpreter was launched and whether it originated from a browser, office application, archive utility, or remote access tool.
 31- Check whether the same host or user generated additional suspicious process, network, or file events around the same time.
 32- If the payload can be safely decoded in an isolated environment, inspect the decoded content for follow-on execution, credential access, persistence, or download behavior.
 33
 34### False positive analysis
 35
 36- Administrative automation, packaging workflows, or developer tooling may legitimately pass large encoded blobs to scripting interpreters.
 37- PowerShell remoting, software deployment frameworks, or internal bootstrap scripts can occasionally use encoded commands; validate the source, user, and expected automation context.
 38
 39### Response and remediation
 40
 41- Isolate the affected host if the decoded content or surrounding activity indicates malicious execution.
 42- Terminate the suspicious interpreter process and any spawned child processes.
 43- Preserve the full command line and related process tree for forensic analysis before making changes on the host.
 44- Reset or revoke any credentials, tokens, or secrets exposed by the decoded payload or subsequent attacker activity.
 45"""
 46risk_score = 73
 47rule_id = "74d31cb7-4a2c-44fe-9d1d-f375b9f3cb61"
 48severity = "high"
 49tags = [
 50    "Domain: Endpoint",
 51    "OS: Windows",
 52    "OS: macOS",
 53    "OS: Linux",
 54    "Use Case: Threat Detection",
 55    "Tactic: Defense Evasion",
 56    "Tactic: Execution",
 57    "Data Source: Elastic Defend",
 58    "Resources: Investigation Guide",
 59    "Noise: Unknown",
 60    "Performance: Normal",
 61    "Profile: Recommended",
 62    "Threat: Encoding-Based Obfuscation",
 63    "Threat: Script-Based Execution",
 64    "Rule Type: ES|QL",
 65    "Platform: Windows",
 66    "Platform: Linux",
 67    "Platform: macOS",
 68]
 69timestamp_override = "event.ingested"
 70type = "esql"
 71
 72query = '''
 73FROM logs-endpoint.events.process-* METADATA _id, _index, _version, _ignored
 74| MV_EXPAND _ignored
 75| WHERE _ignored == "process.command_line"
 76| WHERE event.category == "process" and event.type == "start"
 77| EVAL command_line = TO_LOWER(process.command_line.text),
 78       pname = TO_LOWER(process.name)
 79| EVAL has_long_base64 = command_line RLIKE """.*[a-z0-9+/]{100,}={0,2}.*"""
 80| WHERE
 81(
 82    (
 83        /* Python: decode primitive + plausible Base64 payload */
 84        pname LIKE "python*" AND
 85        has_long_base64 AND
 86        (
 87            command_line LIKE "*b64decode*" OR
 88            (command_line LIKE "*-c*" AND command_line LIKE "*base64*")
 89        ) AND NOT (process.parent.name == "codex" AND (command_line LIKE "*.write(base64.*" or command_line LIKE "*.write_bytes(base64*"))
 90    ) OR
 91    (
 92        /* PowerShell: encoded command or explicit Base64 decode + payload */
 93        (pname LIKE "powershell*" OR pname LIKE "pwsh*") AND
 94        has_long_base64 AND
 95        (
 96            command_line RLIKE """.* -(e|en|enc|enco|encod|encode|encoded|encodedcommand) .+""" OR
 97            command_line LIKE "*-encodedcommand*" OR
 98            command_line LIKE "*frombase64string*"
 99        )
100    ) OR
101    (
102        /* Node.js */
103        pname LIKE "node*" AND
104        has_long_base64 AND
105        (
106            (command_line LIKE "*buffer.from*" AND command_line LIKE "*base64*") OR
107            command_line LIKE "*atob(*"
108        )
109    ) OR
110    (
111        /* Deno */
112        pname LIKE "deno*" AND
113        has_long_base64 AND
114        (
115            command_line LIKE "*atob(*" OR
116            (command_line LIKE "*buffer.from*" AND command_line LIKE "*base64*") OR
117            command_line LIKE "*eval(*"
118        )
119    )
120)
121| EVAL Esql.length_cmdline = LENGTH(command_line)
122| WHERE Esql.length_cmdline >= 4000
123| DROP _ignored, pname, has_long_base64
124| KEEP @timestamp, _id, _version, _index, data_stream.namespace,
125       user.name, user.id, host.name, host.id, agent.id,
126       process.entity_id, process.executable,
127       process.parent.entity_id, process.parent.executable,
128       process.command_line.text, process.parent.command_line
129'''
130
131[rule.alert_suppression]
132group_by = ["host.id", "process.executable", "process.parent.executable"]
133duration = {value = 8, unit = "h"}
134missing_fields_strategy = "suppress"
135
136[[rule.threat]]
137framework = "MITRE ATT&CK"
138
139[[rule.threat.technique]]
140id = "T1027"
141name = "Obfuscated Files or Information"
142reference = "https://attack.mitre.org/techniques/T1027/"
143
144[[rule.threat.technique]]
145id = "T1140"
146name = "Deobfuscate/Decode Files or Information"
147reference = "https://attack.mitre.org/techniques/T1140/"
148
149[rule.threat.tactic]
150id = "TA0005"
151name = "Defense Evasion"
152reference = "https://attack.mitre.org/tactics/TA0005/"
153
154[[rule.threat]]
155framework = "MITRE ATT&CK"
156
157[[rule.threat.technique]]
158id = "T1059"
159name = "Command and Scripting Interpreter"
160reference = "https://attack.mitre.org/techniques/T1059/"
161
162[[rule.threat.technique.subtechnique]]
163id = "T1059.001"
164name = "PowerShell"
165reference = "https://attack.mitre.org/techniques/T1059/001/"
166
167[[rule.threat.technique.subtechnique]]
168id = "T1059.006"
169name = "Python"
170reference = "https://attack.mitre.org/techniques/T1059/006/"
171
172[[rule.threat.technique.subtechnique]]
173id = "T1059.007"
174name = "JavaScript"
175reference = "https://attack.mitre.org/techniques/T1059/007/"
176
177[rule.threat.tactic]
178id = "TA0002"
179name = "Execution"
180reference = "https://attack.mitre.org/tactics/TA0002/"