Testing the base64 encoded file in sys32

Hunt Hypothesis

This hunt targets adversaries who execute Base64-encoded files within the Sys32 directory to evade signature-based detection by mimicking legitimate system artifacts. Proactive hunting for this behavior in Azure Sentinel is essential because attackers frequently leverage these benign-looking locations and encoding techniques to establish persistence or deliver payloads before triggering high-severity alerts.

YARA Rule

rule pos_uploader
{
meta:
	author = "@patrickrolsen"
	maltype = "Point of Sale (POS) Malware"
    reference = "http://blogs.mcafee.com/mcafee-labs/analyzing-the-target-point-of-sale-malware"
	version = "0.1"
	description = "Testing the base64 encoded file in sys32"
	date = "01/30/2014"
strings:
	$s1 = "cmd /c net start %s"
	$s2 = "ftp -s:%s"
	$s3 = "data_%d_%d_%d_%d_%d.txt"
	$s4 = "\\uploader\\"
condition:
	uint16(0) == 0x5A4D and all of ($s*)
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 4 string patterns in its detection logic.

References

• http://blogs.mcafee.com/mcafee-labs/analyzing-the-target-point-of-sale-malware
• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the rule “Testing the base64 encoded file in sys32”, tailored for a legitimate enterprise environment:

• Microsoft Defender Antivirus Real-Time Scanning

  • Scenario: The Microsoft Defender Antivirus service (MsMpEng.exe) frequently scans and processes large update definition files or quarantined items stored in %SystemRoot%\SysWOW64 or C:\Windows\System32. During these operations, the engine often decodes Base64-encoded metadata or signature blobs within these directories to verify file integrity.
  • Filter/Exclusion: Exclude processes with the executable path containing \Program Files\Microsoft Defender\Antivirus\MsMpEng.exe and filter out events where the parent process is svchost.exe (Service Host) running under the “Local System” account.

• Windows Update Service (WUAgent) Deployment

  • Scenario: When Windows Update (wuauclt.exe or UsocoreWorker.exe) downloads and stages cumulative updates, it unpacks .cab or .msu packages into the System32\SoftwareDistribution folder. This process involves reading Base64-encoded manifests and certificate chains located within System32 to validate the update signature before installation.
  • Filter/Exclusion: Create an exclusion for the executable path \Windows\System32\usocoreworker.exe or \Windows\System32\wuauclt.exe, specifically targeting file access events where the accessed filename ends with .manifest, .cab, or contains update in the directory path.

• Scheduled PowerShell Maintenance Scripts

  • Scenario: Enterprise administrators often deploy scheduled tasks (via Task Scheduler) that run PowerShell scripts (powershell.exe) to perform log rotation, configuration backups, or inventory checks. These scripts frequently use