title: Base64 Encoded Listing of Shadowcopy
id: 47688f1b-9f51-4656-b013-3cc49a166a36
status: test
description: Detects base64 encoded listing Win32_Shadowcopy
author: Christian Burkard
date: 2022/03/01
modified: 2022/03/07
tags:
    - attack.execution
    - attack.t1059.001
    - attack.defense_evasion
    - attack.t1027
references:
    - https://github.com/Neo23x0/Raccine/blob/main/yara/mal_revil.yar
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    # Win32_Shadowcopy | ForEach-Object
    CommandLine|contains: 
      - 'VwBpAG4AMwAyAF8AUwBoAGEAZABvAHcAYwBvAHAAeQAgAHwAIABGAG8AcgBFAGEAYwBoAC0ATwBiAGoAZQBjAHQA'
      - 'cAaQBuADMAMgBfAFMAaABhAGQAbwB3AGMAbwBwAHkAIAB8ACAARgBvAHIARQBhAGMAaAAtAE8AYgBqAGUAYwB0A'
      - 'XAGkAbgAzADIAXwBTAGgAYQBkAG8AdwBjAG8AcAB5ACAAfAAgAEYAbwByAEUAYQBjAGgALQBPAGIAagBlAGMAdA'
  condition: selection
fields:
  - CommandLine
  - ParentCommandLine
falsepositives:
  - Unlikely
level: high