Detects a suspicious base64 encoded keyword

Hunt Hypothesis

This rule detects adversaries leveraging Base64 encoding to obfuscate malicious keywords within command-line arguments or network payloads, effectively hiding indicators of compromise from standard signature-based detection. A proactive hunt is essential in Azure Sentinel because encoded data often bypasses initial security controls, allowing attackers to execute stealthy commands that could lead to lateral movement or data exfiltration if not identified early.

YARA Rule

rule SUSP_Base64_Encoded_Hacktool_Dev {
   meta:
      description = "Detects a suspicious base64 encoded keyword"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://twitter.com/cyb3rops/status/1270626274826911744"
      date = "2020-06-10"
      score = 65
      id = "6dc7db4b-a614-51e4-a9a5-f869154dbbb1"
   strings:
      $ = "QGdlbnRpbGtpd2" ascii wide 
      $ = "BnZW50aWxraXdp" ascii wide 
      $ = "AZ2VudGlsa2l3a" ascii wide
      $ = "QGhhcm1qMH" ascii wide
      $ = "BoYXJtajB5" ascii wide
      $ = "AaGFybWowe" ascii wide
      $ = "IEBzdWJ0ZW" ascii wide
      $ = "BAc3VidGVl" ascii wide
      $ = "gQHN1YnRlZ" ascii wide
   condition:
      filesize < 6000KB and 1 of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

Microsoft Defender for Endpoint — Custom indicators / advanced hunting
Email Gateway — Attachment scanning
File Share Monitoring — Periodic scanning of shared drives
YARA CLI — Manual threat hunting on endpoints

References

False Positive Guidance

Here are 5 specific false positive scenarios for the “Detects a suspicious base64 encoded keyword” rule, along with recommended filters and exclusions:

Scenario: Microsoft Office Add-in Deployment via PowerShell
- Context: Enterprise administrators frequently use PowerShell to deploy or update Office add-ins (e.g., VSTO manifests) where configuration strings are embedded in Base64. For example, a script running Install-Addin -Config $Base64String might trigger the rule when processing large XML payloads encoded in Base64.
- Filter/Exclusion: Exclude processes named powershell.exe or pwsh.exe where the command line contains keywords like -Command, -File, or specific Office deployment paths (e.g., C:\Program Files\Microsoft Office).
Scenario: Scheduled Backup Jobs Utilizing Base64 Metadata
- Context: Automated backup solutions like Veeam Backup & Replication or Rubrik often generate status reports or log entries containing Base64-encoded metadata (such as checksums, certificate fingerprints, or job identifiers) within their scheduled tasks. These jobs run nightly and may process large encoded strings that mimic suspicious activity.
- Filter/Exclusion: Create an exclusion for the specific service accounts running these backups (e.g., NT SERVICE\VeeamTransport or RubrikAgent) and filter out events where the parent process is vbr.exe or rubrik-agent.exe.
Scenario: CI/CD Pipeline Artifact Processing
- Context: In DevOps environments, tools like Jenkins, Azure DevOps, or GitHub Actions agents frequently decode Base64 strings during the build and deployment phases. This often occurs when pulling Docker images, processing environment variable secrets stored in Base64 format, or handling GitHub Actions workflow