Base16 or Base32 Encoding/Decoding Activity

About

Tags

Domain: EndpointOS: LinuxUse Case: Threat DetectionTactic: Defense EvasionData Source: Elastic EndgameData Source: Elastic DefendData Source: Auditd ManagerData Source: CrowdstrikeData Source: SentinelOneLanguage: eql

Severity

low

Risk Score

21

MITRE ATT&CK™

Defense Evasion (TA0005)(opens in a new tab or window)

↳ Obfuscated Files or Information (T1027)(opens in a new tab or window)

↳ Deobfuscate/Decode Files or Information (T1140)(opens in a new tab or window)

False Positive Examples

Automated tools such as Jenkins may encode or decode files as part of their normal behavior. These events can be filtered by the process executable or username values.

License

Elastic License v2(opens in a new tab or window)

Definition

Rule Type

Event Correlation Rule

Integration Pack

Prebuilt Security Detection Rules

Index Patterns

auditbeat-*endgame-*logs-auditd_manager.auditd-*logs-crowdstrike.fdr*logs-endpoint.events.process*logs-sentinel_one_cloud_funnel.*

Related Integrations

endpoint(opens in a new tab or window)

auditd_manager(opens in a new tab or window)

crowdstrike(opens in a new tab or window)

sentinel_one_cloud_funnel(opens in a new tab or window)

Query

process where host.os.type == "linux" and event.type == "start" and
 event.action in ("exec", "exec_event", "start", "ProcessRollup2", "executed", "process_started") and
 process.name in ("base16", "base32", "base32plain", "base32hex") and
not process.args in ("--help", "--version")