Rule Document 1:12800

Rule Category

INDICATOR-SHELLCODE --

Alert Message

INDICATOR-SHELLCODE base64 x86 NOOP

Rule Explanation

The rule looks for a base64 string that translates to a number of 0x43 bytes in succession. These bytes are x86 opcodes for the command `inc ebx`. This type of opcode is commonly used in shellcode as a no-operation, commonly referred to as NOP. More than one of these in a row would be indicative of a NOP sled where an attacker is using an exploit to corrupt memory in a specific way that could potential gain execution on a victim machine.

What To Look For

This rule is triggered when a base64 string that is commonly used in exploits to gain execution on a host is observed.

Known Usage

Attacks/Scans seen in the wild

False Positives

Known false positives, with the described conditions

This rule is known to commonly result in false positive alerts and must be reviewed in order to confirm an exploit attempt.

Contributors

Cisco Talos

Rule Groups

No rule groups

CVE

None

Rule Vulnerability

No information provided

CVE Additional Information

This product uses data from the NVD API but is not endorsed or certified by the NVD.

None

MITRE ATT&CK Framework

Tactic: Execution

Technique: User Execution

For reference, see the MITRE ATT&CK vulnerability types here: https://attack.mitre.org