Detects an base64 encoded executable with reversed characters

Hunt Hypothesis

This detection rule identifies adversaries attempting to evade signature-based security controls by encoding executables in Base64 and reversing their character sequences to obscure malicious payloads. A proactive hunt for this behavior is essential within Azure Sentinel to uncover sophisticated fileless attacks that bypass traditional static analysis, ensuring early identification of potential command-and-control or lateral movement activities.

YARA Rule

rule SUSP_Reversed_Base64_Encoded_EXE : FILE {
   meta:
      description = "Detects an base64 encoded executable with reversed characters"
      author = "Florian Roth (Nextron Systems)"
      date = "2020-04-06"
      reference = "Internal Research"
      score = 80
      hash1 = "7e6d9a5d3b26fd1af7d58be68f524c4c55285b78304a65ec43073b139c9407a8"
      id = "3b52e59e-7c0a-560f-8123-1099c52e7e3d"
   strings:
      $s1 = "AEAAAAEQATpVT"
      $s2 = "AAAAAAAAAAoVT"
      $s3 = "AEAAAAEAAAqVT"
      $s4 = "AEAAAAIAAQpVT"
      $s5 = "AEAAAAMAAQqVT"

      $sh1 = "SZk9WbgM1TEBibpBib1JHIlJGI09mbuF2Yg0WYyd2byBHIzlGaU" ascii
      $sh2 = "LlR2btByUPREIulGIuVncgUmYgQ3bu5WYjBSbhJ3ZvJHcgMXaoR" ascii
      $sh3 = "uUGZv1GIT9ERg4Wag4WdyBSZiBCdv5mbhNGItFmcn9mcwBycphGV" ascii
   condition:
      filesize < 10000KB and 1 of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 8 string patterns in its detection logic.

References

• Internal Research
• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the rule “Detects an base64 encoded executable with reversed characters,” along with suggested filters or exclusions:

• Scenario: PowerShell Script Execution via Scheduled Tasks

  • Context: Enterprise IT administrators often use Task Scheduler to run maintenance scripts. A common pattern involves a script that fetches a configuration blob from an internal repository, decodes it using Base64, and then reverses the string for legacy compatibility before passing it to a downstream process (e.g., powershell.exe -Command "& { ... }").
  • Suggested Filter: Exclude processes where the parent is taskschd.exe or svchost.exe running under the context of specific scheduled task IDs known to handle configuration ingestion. Additionally, filter out if the Base64 payload length exceeds 10KB and contains a standard header signature (e.g., UyB...).

• Scenario: Microsoft Defender for Endpoint (MDE) Custom Script Analysis

  • Context: Security teams frequently deploy custom detection scripts via MDE that utilize PowerShell to analyze logs. These scripts often encode log entries into Base64, reverse the character order to obfuscate data before transmission to a SIEM, and then execute the logic locally.
  • Suggested Filter: Create an exclusion for msenghost.exe or SenseBrokerService.exe when the command line arguments contain specific keywords like -EncodedCommand, -ReverseString, or custom script GUIDs associated with known security automation policies.

• Scenario: Azure DevOps CI/CD Pipeline Agent Execution

  • Context: In hybrid cloud environments, on-premise build agents (e.g., hosted by VSTS.Agent.exe) often process artifacts during the deployment phase. A specific step in the pipeline may involve decoding a Base64-encoded binary artifact,