MediumMicrosoft Sentinel analytics Thomas McElroy

Windows host username encoded in base64 web request

This detection will identify network requests in HTTP proxy data that contains Base64 encoded usernames from machines in the DeviceEvents table. This technique was seen usee by POLONIUM in their RunningRAT tool.

Detection logic

Detection requirements

Platform: ESXi Linux macOS Network Devices Windows
The rule states no platform. This is derived from the 2 ATT&CK techniques it maps to.
Log source product: checkpoint fortinet microsoftthreatprotection paloaltonetworks zscaler
Log source service: commonsecuritylog devicenetworkevents

Detection rules

Windows host username encoded in base64 web request

Detection logic

Detection requirements

MITRE ATT&CK mappings

From the source

Licence

Authorship

Detection rules