Detects hex encoded code that has been base64 encoded

Hunt Hypothesis

This detection rule identifies adversaries employing double encoding (hex within Base64) to obfuscate malicious payloads and evade signature-based security controls. Proactively hunting for this behavior in Azure Sentinel is critical because such complex encoding often signals advanced command-and-control traffic or staged execution attempts that standard rules may miss due to their nested structure.

YARA Rule

rule SUSP_Base64_Encoded_Hex_Encoded_Code {
   meta:
      author = "Florian Roth (Nextron Systems)"
      description = "Detects hex encoded code that has been base64 encoded"
      date = "2019-04-29"
      score = 65
      reference = "https://www.nextron-systems.com/2019/04/29/spotlight-threat-hunting-yara-rule-example/"
      id = "2cfd278f-ff45-5e23-b552-dad688ab303b"
   strings:
      $x1 = { 78 34 4e ?? ?? 63 65 44 ?? ?? 58 48 67 }
      $x2 = { 63 45 44 ?? ?? 58 48 67 ?? ?? ?? 78 34 4e }

      $fp1 = "Microsoft Azure Code Signp$"
   condition:
      1 of ($x*) and not 1 of ($fp*)
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

Microsoft Defender for Endpoint — Custom indicators / advanced hunting
Email Gateway — Attachment scanning
File Share Monitoring — Periodic scanning of shared drives
YARA CLI — Manual threat hunting on endpoints

This rule contains 3 string patterns in its detection logic.

References

False Positive Guidance

Here are 5 specific false positive scenarios for the rule “Detects hex encoded code that has been base64 encoded,” along with suggested filters or exclusions:

Scenario: Microsoft Defender for Endpoint (MDE) or CrowdStrike Falcon agents performing scheduled binary signature updates.
- Context: During nightly update cycles, these EDR agents often download payload definitions where the raw hex signature data is wrapped in a Base64 string within the configuration JSON before being written to disk or transmitted via telemetry.
- Filter/Exclusion: Create an exclusion for processes running under C:\Program Files\Microsoft Defender\MsMpEng.exe (or the specific CrowdStrike service executable) where the command line contains keywords like “update,” “signature,” or “sync.”
Scenario: PowerShell scripts utilizing ConvertTo-Base64String on binary files for configuration management.
- Context: DevOps teams frequently use scheduled PowerShell jobs (e.g., via Azure Automation or Task Scheduler) to embed binary certificates, icons, or small executables into JSON/YAML config files by converting the hex content of these binaries into Base64 strings.
- Filter/Exclusion: Exclude events where the parent process is powershell.exe and the command line contains parameters such as -Command, -File, or specific script paths ending in .ps1 located within a known “Automation” or “Scripts” directory.
Scenario: Docker container orchestration (Kubernetes/Docker Engine) pulling image layers.
- Context: When Kubernetes pulls container images from registries, the image manifests and layer blobs often contain hex-encoded binary data that is Base64 encoded within the dockerd or kubelet communication logs to ensure safe transmission over HTTP/HTTPS.
- Filter/Exclusion: Filter out events generated by processes named `