Detect Data Encoding in Google Chronicle

rule t1132_data_encoding_c2_communication {
  meta:
    author = "Argus Detection Engineering"
    description = "Detects T1132 Data Encoding techniques used to obfuscate C2 traffic. Covers certutil LOLBin encoding, scripting interpreters combining encoding with network primitives, PowerShell Base64 conversion with networking classes, and curl/wget with large encoded argument blobs."
    mitre_attack_tactic = "Command and Control"
    mitre_attack_technique = "T1132"
    mitre_attack_subtechnique = "T1132.001"
    severity = "HIGH"
    priority = "HIGH"

  events:
    $e.metadata.event_type = "PROCESS_LAUNCH"
    $e.principal.hostname = $hostname
    $e.target.process.command_line = $cmdline
    $e.target.process.file.full_path = $proc_path

    (
      // Branch 1: certutil encoding/decoding LOLBin
      (
        re.regex($e.target.process.file.full_path, `(?i)certutil\.exe`)
        and re.regex($e.target.process.command_line, `(?i)(-encode|-decode|-urlcache|/encode|/decode|/urlcache)`)
      )
      or
      // Branch 2: scripting interpreters with encoding + network primitives
      (
        re.regex($e.target.process.file.full_path, `(?i)(python[23]?\.exe|perl\.exe|php\.exe|ruby\.exe|node\.exe|nodejs)`)
        and re.regex($e.target.process.command_line, `(?i)(base64|b64encode|b64decode|binascii|hexlify|unhexlify|zlib\.compress|gzip|btoa|atob|urllib\.parse\.quote|hex_codec)`)
        and re.regex($e.target.process.command_line, `(?i)(http://|https://|ftp://|socket|urllib|requests\.|connect\()`)
      )
      or
      // Branch 3: PowerShell Base64 conversion with network class usage
      (
        re.regex($e.target.process.file.full_path, `(?i)(powershell\.exe|pwsh\.exe)`)
        and re.regex($e.target.process.command_line, `(?i)(FromBase64String|ToBase64String|\[Convert\]::|System\.Convert)`)
        and re.regex($e.target.process.command_line, `(?i)(Net\.WebClient|Invoke-WebRequest|Invoke-RestMethod|TcpClient|UdpClient|UploadString|DownloadString)`)
      )
      or
      // Branch 4: curl/wget with long Base64 or hex-encoded argument
      (
        re.regex($e.target.process.file.full_path, `(?i)(curl\.exe|wget\.exe|/curl$|/wget$)`)
        and (
          re.regex($e.target.process.command_line, `[A-Za-z0-9+/]{60,}={0,2}`)
          or re.regex($e.target.process.command_line, `[0-9a-fA-F]{80,}`)
        )
      )
    )

  condition:
    $e
}