Detects suspicious file with base64 encoded payload in blocks

Hunt Hypothesis

This hunt hypothesis targets adversaries who utilize Base64-encoded payloads within file blocks to obfuscate malicious content and evade signature-based detection mechanisms. Proactively hunting for this behavior in Azure Sentinel is critical because encoded data often conceals command-and-control traffic or embedded scripts that standard antivirus solutions may fail to inspect deeply, thereby reducing the risk of undetected lateral movement or initial compromise.

YARA Rule

rule SUSP_Script_Base64_Blocks_Jun20_1 {
   meta:
      description = "Detects suspicious file with base64 encoded payload in blocks"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://posts.specterops.io/covenant-v0-5-eee0507b85ba"
      date = "2020-06-05"
      score = 70
      id = "cef759a5-b02a-53e7-bf27-184eee6bc3fa"
   strings:
      $sa1 = "<script language=" ascii
      $sb2 = { 41 41 41 22 2B 0D 0A 22 41 41 41 }
   condition:
      all of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

Microsoft Defender for Endpoint — Custom indicators / advanced hunting
Email Gateway — Attachment scanning
File Share Monitoring — Periodic scanning of shared drives
YARA CLI — Manual threat hunting on endpoints

This rule contains 2 string patterns in its detection logic.

References

False Positive Guidance

Here are 5 specific false positive scenarios for the rule “Detects suspicious file with base64 encoded payload in blocks,” along with targeted filters and exclusions:

Scenario: PowerShell Script Execution via Scheduled Tasks
- Context: An administrator creates a scheduled task (e.g., Task Scheduler running powershell.exe) that executes a script containing embedded configuration data or certificates. These scripts often store large JSON configurations or binary blobs as Base64 strings within the script file to ensure portability across different environments.
- Filter/Exclusion: Exclude files where the parent process is TaskSchedulerService (svchost.exe) and the file extension is .ps1, located specifically in the C:\Windows\System32\Tasks or a dedicated administration script folder (e.g., C:\AdminScripts).
Scenario: Office 365/Teams Update Manifests
- Context: During routine updates for Microsoft Teams or Outlook, the client generates temporary manifest files or configuration blocks that include Base64 encoded payload data describing update modules and feature flags. These are often written to %LocalAppData%\Microsoft\Teams or similar directories before being processed by the update service.
- Filter/Exclusion: Create an exclusion for file paths containing Microsoft\Teams\Current or Microsoft\Office16, specifically targeting files with extensions .json, .xml, or .manifest generated by processes named TeamsUpdate.exe or OsfClient.exe.
Scenario: Antivirus Quarantine and Reporting Logs
- Context: Enterprise Endpoint Detection and Response (EDR) agents like CrowdStrike Falcon, Microsoft Defender for Endpoint, or Symantec often generate detailed incident reports or quarantine logs. These logs frequently embed the actual malware signature hashes or file metadata in Base64 format within a text block to facilitate