Question Analysis

// Step 1: Find commands that decode base64 to an output file let decoded_scripts = DeviceProcessEvents | where ProcessCommandLine contains "base64" and ProcessCommandLine has_any ("-d", ">", ">>") | extend script_file = extract(@"> *([/\w\d_.-]+)", 1, ProcessCommandLine) | where isnotempty(script_file) | project DeviceId, script_file, decoded_time=ProcessCreationTime; // Step 2: Look for executions of that script file on the same device soon after DeviceProcessEvents | join kind=inner (decoded_scripts) on DeviceId | where (FileName == script_file or ProcessCommandLine has script_file) | where ProcessCreationTime > decoded_time and ProcessCreationTime < decoded_time + 1h | summarize FirstExecutionTime=min(ProcessCreationTime) by DeviceName, script_file, FileName | project DeviceName, GeneratedAndExecutedScript=script_file, FileName_Executed=FileName, FirstExecutionTime

// Identify base64 decoding processes with output redirected to a .sh file DeviceProcessEvents | where InitiatingProcessCommandLine has "base64 -d" | where InitiatingProcessCommandLine matches regex "> .+\\.sh" | project ParentCommandLine = InitiatingProcessCommandLine, ParentProcessName = InitiatingProcessFileName, ParentProcessId = ProcessId, DeviceId, DeviceName, TimeGenerated, AccountName, AccountDomain, AccountSid | join kind=inner ( DeviceProcessEvents | where InitiatingProcessCommandLine matches regex " sh " | project ChildProcessName = InitiatingProcessFileName, ChildCommandLine = InitiatingProcessCommandLine, DeviceId, DeviceName, AccountName, AccountDomain, ProcessId, TimeGenerated ) on DeviceId, DeviceName | project TimeGenerated, DeviceName, AccountName, AccountDomain, ParentProcessName, ParentCommandLine, ChildProcessName, ChildCommandLine, ScriptName = tostring(split(ChildCommandLine, ' ')[-1]) | sort by TimeGenerated desc | extend Tactic = "Execution", Technique = "Linux Bash Script Execution", TechniqueID = "T1059.004" | summarize FirstTimeDecoded = min(TimeGenerated), EventCount = count() by DeviceName, AccountName, AccountDomain, ParentProcessName, ParentCommandLine, ChildProcessName, ChildCommandLine, ScriptName, Tactic, Technique, TechniqueID | sort by FirstTimeDecoded desc

DeviceInfo | where OSPlatform == 'Linux' | project DeviceId | join kind=inner (DeviceProcessEvents) on DeviceId | where ProcessCommandLine has 'base64' and (ProcessCommandLine has '-d' or ProcessCommandLine has 'decode') | project FileName, DeviceId, ProcessCommandLine | summarize Filename = make_set(FileName) by DeviceId // Summarizes to get unique filenames per device for clarity

DeviceProcessEvents | where InitiatingProcessCommandLine has "base64" and (InitiatingProcessCommandLine has "-d" or InitiatingProcessCommandLine has "--decode") | extend DecodedFile = extract(@">\s*(\S+\.sh)", 1, InitiatingProcessCommandLine) | where isnotempty(DecodedFile) | summarize LatestTime = arg_max(TimeGenerated, *) by DecodedFile | project TimeGenerated = LatestTime, DecodedFile