mandiant-capa-rules/data-manipulation/encoding/base64/encode-data-using-base64.yml

rule:
  meta:
    name: encode data using Base64
    namespace: data-manipulation/encoding/base64
    author: moritz.raabe@mandiant.com
    scope: function
    att&ck:
      - Defense Evasion::Obfuscated Files or Information [T1027]
    mbc:
      - Defense Evasion::Obfuscated Files or Information::Encoding-Standard Algorithm [E1027.m02]
      - Data::Encode Data::Base64 [C0026.001]
    examples:
      - BFB9B5391A13D0AFD787E87AB90F14F5:0x1314889C
      - 074072B261FC27B65C72671F13510C05:0x100049B2
      - 5DB2D2BE20D59AA0BE6709A6850F1775:0x18001CC30
      - 08AC667C65D36D6542917655571E61C8:0x406EAA
  features:
    - and:
      - mnemonic: shl
      - mnemonic: shr
      - number: 0x3F = modulo 64
      - or:
        - number: 0x3D = '='
        - number: 0x3D3D = '=='
      - match: contain loop
      - optional:
        - number: 2
        - number: 3
        - number: 4
        - number: 6
        - number: 0xF
        - string: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"