Unable to perform string matching on decoded base64 data in MS Sentinel SIEM using KQL search. I am running a MS Sentinel KQL search published at the link below.
For example, when modifying the original query by adding the the statement
*"| where DecodedCommand contains "some text present in DecodedCommand data" *
I would expect a match but no results are returned. I've confirmed that the statement is valid by performing a string match on data in another column. The problem is only for the decoded base 64 data.
Original query (link below):
DeviceProcessEvents
| where ProcessCommandLine contains "powershell" or InitiatingProcessCommandLine contains "powershell"
| where ProcessCommandLine contains "-enc"
or ProcessCommandLine contains "-encodedcommand"
or InitiatingProcessCommandLine contains "-enc"
or InitiatingProcessCommandLine contains "-encodedcommand"
//Extract encoded command using regex
//This query will only return results when the command can be matched via regex and decoded, if you run only the above lines it will return all encoded commands without attempting to match and decode
| extend EncodedCommand = extract(@'\s+([A-Za-z0-9+/]{20}\S+$)', 1, ProcessCommandLine)
| where EncodedCommand != ""
| extend DecodedCommand = base64_decode_tostring(EncodedCommand)
| where DecodedCommand != ""
| project
TimeGenerated,
DeviceName,
InitiatingProcessAccountName,
InitiatingProcessCommandLine,
ProcessCommandLine,
EncodedCommand,
DecodedCommand
Modified query:
DeviceProcessEvents
| where ProcessCommandLine contains "powershell" or InitiatingProcessCommandLine contains "powershell"
| where ProcessCommandLine contains "-enc"
or ProcessCommandLine contains "-encodedcommand"
or InitiatingProcessCommandLine contains "-enc"
or InitiatingProcessCommandLine contains "-encodedcommand"
//Extract encoded command using regex
//This query will only return results when the command can be matched via regex and decoded, if you run only the above lines it will return all encoded commands without attempting to match and decode
| extend EncodedCommand = extract(@'\s+([A-Za-z0-9+/]{20}\S+$)', 1, ProcessCommandLine)
| where EncodedCommand != ""
| extend DecodedCommand = base64_decode_tostring(EncodedCommand)
| where DecodedCommand != ""
| where DecodedCommand contains "add some text here"
| project
TimeGenerated,
DeviceName,
InitiatingProcessAccountName,
InitiatingProcessCommandLine,
ProcessCommandLine,
EncodedCommand,
DecodedCommand
I have tried various string matching techniques on the DecodedCommand values such as using regex and queries to a lookup list (e.g., adding statements "| let str_to_match=dynamic(['some string to match']) and | where DecodedCommand has_any(str_to_match) to the original query).
