Detect Encrypted/Encoded File in Google Chronicle

rule T1027_013_Encrypted_Encoded_File_Execution {
  meta:
    author = "Detection Engineering"
    description = "Detects runtime payload decoding and encrypted/encoded file execution patterns associated with T1027.013 Encrypted/Encoded File. Covers certutil decode, PowerShell Base64+exec chains, XOR decode via bxor, password-protected archive extraction via 7z/WinRAR, and scripting engine execution of encoded content."
    mitre_attack_technique = "T1027.013"
    mitre_attack_tactic = "Defense Evasion"
    mitre_attack_url = "https://attack.mitre.org/techniques/T1027/013/"
    severity = "HIGH"
    confidence = "HIGH"
    version = "1.0"

  events:
    $proc.metadata.event_type = "PROCESS_LAUNCH"

    (
      (
        re.regex($proc.target.process.file.full_path, `(?i)certutil\.exe$`) and
        re.regex($proc.target.process.command_line, `(?i)-(decode|decodehex)`)
      ) or
      (
        re.regex($proc.target.process.file.full_path, `(?i)powershell\.exe$`) and
        re.regex($proc.target.process.command_line, `(?i)FromBase64String`) and
        re.regex($proc.target.process.command_line, `(?i)(Invoke-Expression|\biex\b|&\(|\.Invoke)`)
      ) or
      (
        re.regex($proc.target.process.file.full_path, `(?i)powershell\.exe$`) and
        re.regex($proc.target.process.command_line, `(?i)\bbxor\b`)
      ) or
      (
        re.regex($proc.target.process.file.full_path, `(?i)(7z|7za|winrar|wrar)\.exe$`) and
        re.regex($proc.target.process.command_line, `-p\S+`)
      ) or
      (
        re.regex($proc.target.process.file.full_path, `(?i)(mshta|wscript|cscript)\.exe$`) and
        re.regex($proc.target.process.command_line, `(?i)(Base64|FromBase64|\bbxor\b|Encoding)`)
      )
    )

  condition:
    $proc
}