[New Rule] Multi-Base64 Decoding Attempt from Suspicious Location

[Aegrah]

Summary

This rule detects the execution of multiple base64 decoding commands to decode data. multi-decoded data is suspicious, and may be used by attackers to obfuscate malicious payloads or commands.

This rule was ported from Endpoint to SIEM, due to its FP rate.

[tradebot-elastic]

⛔️ Test failed

Results

• ❌ Multi-Base64 Decoding Attempt from Suspicious Location (eql)
  • coverage_issue: no_rta
  • stack_validation_failed: no_rta