possible includes base64 packed functions

Hunt Hypothesis

This detection identifies suspicious processes or scripts that incorporate Base64-encoded packed functions, a common obfuscation technique used by adversaries to conceal malicious logic and evade static analysis. Proactively hunting for these patterns in Azure Sentinel is critical because low-severity alerts often represent early-stage reconnaissance or fileless attacks that could escalate into significant threats if the encoded payload’s behavior remains unexamined.

YARA Rule

rule possible_includes_base64_packed_functions  
{ 
	meta: 
		impact = 5 
		hide = true 
		desc = "Detects possible includes and packed functions" 
	strings: 
		$f = /(atob|btoa|;base64|base64,)/ nocase
		//$ff = /(?:[A-Za-z0-9]{4}){2,}(?:[A-Za-z0-9]{2}[AEIMQUYcgkosw048]=|[A-Za-z0-9][AQgw]==)/ nocase 
		$fff = /([A-Za-z0-9]{4})*([A-Za-z0-9]{2}==|[A-Za-z0-9]{3}=|[A-Za-z0-9]{4})/ 
	condition: 
		$f and $fff
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 3 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 3-5 specific false positive scenarios for the possible_includes_base64_packed_functions detection rule, along with recommended filters or exclusions:

• Scenario: Automated PowerShell Script Execution via Scheduled Tasks

  • Context: Enterprise administrators frequently use Task Scheduler to run maintenance scripts (e.g., log rotation, backup verification) that embed Base64-encoded configuration strings or function definitions directly within the script body. When these scripts execute via powershell.exe, they often trigger high entropy scores characteristic of packed functions.
  • Filter/Exclusion: Exclude processes where the command line contains -EncodedCommand and the parent process is Task Scheduler Service (svchost.exe -k netsvcs) or System. Additionally, whitelist specific script paths in C:\ProgramData\Company\ScheduledScripts\*.

• Scenario: Microsoft Defender for Endpoint (MDE) Live Response & Policy Updates

  • Context: The Microsoft Defender client (MsMpEng.exe or SenseiService) periodically downloads and unpacks policy updates, threat intelligence feeds, or performs live response queries. These operations often involve decoding Base64 payloads containing sensor definitions or remote procedure calls (RPC) that mimic packed function signatures.
  • Filter/Exclusion: Create a whitelist for the process image path C:\Program Files\Microsoft Defender\MsMpEng.exe and C:\Program Files\Microsoft Defender\SenseiService.exe. Further refine by excluding events where the file hash matches known Microsoft-signed binaries (using a hash allowlist).

• Scenario: CI/CD Pipeline Artifacts Deployment (e.g., Azure DevOps or Jenkins)

  • Context: During deployment windows, CI/CD agents (such as azagent.exe or java.exe running Jenkins) often process YAML manifests or Docker images where