suspicious-base64-encoded-registry-keys

Hunt Hypothesis

Adversaries may encode registry keys in base64 to evade detection while persisting or modifying system configurations. SOC teams should proactively hunt for this behavior in Azure Sentinel to identify potential persistence mechanisms and early-stage compromise attempts.

KQL Query

DeviceRegistryEvents
| where Timestamp > ago(30d)
| where ActionType has_any ('RegistryValueSet','RegistryKeyCreated')
| where isnotempty(RegistryValueData)
| where RegistryValueData matches regex @'\s+([A-Za-z0-9+/]{4,}(?:[A-Za-z0-9+/]{2}[=]{2}|[A-Za-z0-9+/]{3}=)?)\s+' or RegistryValueData matches regex @'^(?:[A-Za-z0-9+\/]{4})*(?:[A-Za-z0-9+\/]{2}==|[A-Za-z0-9+\/]{3}=)?$'
| extend ExtractedB64 = trim(" ",extract(@'(?:\s+)[A-Za-z0-9+\/=]+(?:\s+)',0,RegistryValueData))
| extend DecodedCommand = replace(@'\x00','', base64_decode_tostring(RegistryValueData))
| extend ExtractedDecodedCommand = base64_decode_tostring(ExtractedB64)
| where isnotempty(DecodedCommand) or isnotempty(ExtractedDecodedCommand)
| project Timestamp, DeviceName, DecodedCommand, ExtractedDecodedCommand, RegistryValueData, RegistryKey, RegistryValueName, RegistryValueType, PreviousRegistryValueData, InitiatingProcessFileName, InitiatingProcessCommandLine, InitiatingProcessParentFileName

Analytic Rule Definition

id: 4751319e-6d20-4c26-893d-baaad90f0747
name: suspicious-base64-encoded-registry-keys
description: |
  Looks for suspicious base64 encoded registry keys being created.
  Author: Jouni Mikkola
  References:
  https://threathunt.blog/registry-hunts/
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - DeviceRegistryEvents
tactics:
- Defense evasion
relevantTechniques:
  - T1112
query: |
  DeviceRegistryEvents
  | where Timestamp > ago(30d)
  | where ActionType has_any ('RegistryValueSet','RegistryKeyCreated')
  | where isnotempty(RegistryValueData)
  | where RegistryValueData matches regex @'\s+([A-Za-z0-9+/]{4,}(?:[A-Za-z0-9+/]{2}[=]{2}|[A-Za-z0-9+/]{3}=)?)\s+' or RegistryValueData matches regex @'^(?:[A-Za-z0-9+\/]{4})*(?:[A-Za-z0-9+\/]{2}==|[A-Za-z0-9+\/]{3}=)?$'
  | extend ExtractedB64 = trim(" ",extract(@'(?:\s+)[A-Za-z0-9+\/=]+(?:\s+)',0,RegistryValueData))
  | extend DecodedCommand = replace(@'\x00','', base64_decode_tostring(RegistryValueData))
  | extend ExtractedDecodedCommand = base64_decode_tostring(ExtractedB64)
  | where isnotempty(DecodedCommand) or isnotempty(ExtractedDecodedCommand)
  | project Timestamp, DeviceName, DecodedCommand, ExtractedDecodedCommand, RegistryValueData, RegistryKey, RegistryValueName, RegistryValueType, PreviousRegistryValueData, InitiatingProcessFileName, InitiatingProcessCommandLine, InitiatingProcessParentFileName

Required Data Sources

MITRE ATT&CK Context

• Tactic: Defense evasion
• Technique: T1112 — T1112

References

• [Source Query](https://github.com/Azure/Azure-Sentinel/blob/main/Hunting Queries/Microsoft 365 Defender/Defense evasion/suspicious-base64-encoded-registry-keys.yaml)

False Positive Guidance

• Scenario: Base64 encoding used for obfuscation in a legitimate scheduled job
  Description: A scheduled job uses base64 encoding to obfuscate a registry key name for security purposes or to avoid log visibility.
  Filter/Exclusion: Exclude registry keys that are part of known scheduled tasks (e.g., Task Scheduler tasks) or those containing known base64 patterns used in legitimate obfuscation.
  Example: Task Scheduler tasks with registry keys under HKLM\Software\Microsoft\Windows\CurrentVersion\TaskScheduler\TaskCache

• Scenario: Base64 encoded registry keys used by a legitimate system management tool
  Description: A system management tool (e.g., Microsoft Intune, Configuration Manager, or Ansible) encodes registry keys in base64 for configuration purposes.
  Filter/Exclusion: Exclude registry keys created by known system management tools or those containing base64 strings that match known encoding patterns used by these tools.
  Example: Keys under HKLM\Software\Policies or HKCU\Software\Microsoft\Windows\CurrentVersion\Run

• Scenario: Base64 encoded keys used in a legitimate admin script or PowerShell module
  Description: An admin script or PowerShell module (e.g., PowerShell, Pester, or DSC) uses base64 encoding to store encrypted credentials or configuration data in registry keys.
  Filter/Exclusion: Exclude registry keys that are part of known PowerShell modules or scripts, or those that contain base64 strings matching known encryption patterns.
  Example: Keys under HKLM\Software\Microsoft\PowerShell or HKCU\Software\Microsoft\Windows\PowerShell

• Scenario: Base64 encoding used in a legitimate backup or restore process
  Description: A backup