This query is designed to detect potentially malicious scripts on Linux systems by looking for processes that have Base64 encoded shebang lines in their command lines. Shebang lines are used to specify the interpreter for a script (like #!/bin/bash), and encoding them in Base64 can be a method to hide malicious activity.

Key Points:

• Purpose: Identify scripts that may be trying to hide their true nature by encoding their shebang lines in Base64. - Detection: The query checks for specific Base64 encoded strings that correspond to common shebang lines for various interpreters (e.g., bash, dash, zsh, fish, sh).
• Indicators: The encoded strings it looks for include:
  • IyEvYmluL2Jhc2 (Base64 for #!/bin/bash)
  • IyEvYmluL2Rhc2 (Base64 for #!/bin/dash)
  • IyEvYmluL3pza (Base64 for #!/bin/zsh)
  • IyEvYmluL2Zpc2;IyEvYmluL3No (Base64 for #!/bin/fish and #!/bin/sh)

KQL Query:

The KQL query filters process events to find any command lines that contain these specific Base64 encoded strings.

DeviceProcessEvents
| where ProcessCommandLine has_any ("IyEvYmluL2Jhc2", "IyEvYmluL2Rhc2", "IyEvYmluL3pza", "IyEvYmluL2Zpc2;IyEvYmluL3No")

Tags:

• Base64 Encoding: The method used to encode the shebang lines.
• Shebang Detection: The focus on identifying shebang lines.
• Process Events: The type of events being monitored.
• Linux: The operating system targeted by this detection rule.

In summary, this query helps in identifying obfuscated scripts that might be used for malicious purposes by detecting Base64 encoded shebang lines in process command lines on Linux systems.