✄𐘗
text code block:
✄𐘗FROM logs-endpoint.events.process-* METADATA _id, _index, _version, _ignored
| MV_EXPAND _ignored
| WHERE _ignored == "process.command_line"
| WHERE event.category == "process" and event.type == "start"
| EVAL command_line = TO_LOWER(process.command_line.text),
       pname = TO_LOWER(process.name)
| EVAL has_long_base64 = command_line RLIKE """.*[a-z0-9+/]{100,}={0,2}.*"""
| WHERE
(
    (
        /* Python: decode primitive + plausible Base64 payload */
        pname LIKE "python*" AND
        has_long_base64 AND
        (
            command_line LIKE "*b64decode*" OR
            (command_line LIKE "*-c*" AND command_line LIKE "*base64*")
        ) AND NOT (process.parent.name == "codex" AND (command_line LIKE "*.write(base64.*" or command_line LIKE "*.write_bytes(base64*"))
    ) OR
    (
        /* PowerShell: encoded command or explicit Base64 decode + payload */
        (pname LIKE "powershell*" OR pname LIKE "pwsh*") AND
        has_long_base64 AND
        (
            command_line RLIKE """.* -(e|en|enc|enco|encod|encode|encoded|encodedcommand) .+""" OR
            command_line LIKE "*-encodedcommand*" OR
            command_line LIKE "*frombase64string*"
        )
    ) OR
    (
        /* Node.js */
        pname LIKE "node*" AND
        has_long_base64 AND
        (
            (command_line LIKE "*buffer.from*" AND command_line LIKE "*base64*") OR
            command_line LIKE "*atob(*"
        )
    ) OR
    (
        /* Deno */
        pname LIKE "deno*" AND
        has_long_base64 AND
        (
            command_line LIKE "*atob(*" OR
            (command_line LIKE "*buffer.from*" AND command_line LIKE "*base64*") OR
            command_line LIKE "*eval(*"
        )
    )
)
| EVAL Esql.length_cmdline = LENGTH(command_line)
| WHERE Esql.length_cmdline >= 4000
| DROP _ignored, pname, has_long_base64
| KEEP @timestamp, _id, _version, _index, data_stream.namespace,
       user.name, user.id, host.name, host.id, agent.id,
       process.entity_id, process.executable,
       process.parent.entity_id, process.parent.executable,
       process.command_line.text, process.parent.command_line