1549 add power shell classic eid400 to extract-base64

[fukusuket]

What Changed

• Closed Add PowerShellClassic: EID400 to the target of the extract-base64 command #1549

Evidence

Integration-Test

https://github.com/Yamato-Security/hayabusa/actions/runs/12867115258

I would appreciate it if you could check it out when you have time🙏

[fukusuket]

I tested following case.
Yamato-Security/hayabusa-rules#512 (comment)

PS C:\tmp\hayabusa-3.0.1-win-x64> powershell.exe -e JgAgACgAZwBjAG0AIAAoACcAaQBlAHsAMAB9ACcAIAAtAGYAIAAnAHgAJwApACkAIAAoACIAVwByACIAKwAiAGkAdAAiACsAIgBlAC0ASAAiACsAIgBvAHMAdAAgACcASAAiACsAIgBlAGwAIgArACIAbABvACwAIABmAHIAIgArACIAbwBtACAAUAAiACsAIgBvAHcAIgArACIAZQByAFMAIgArACIAaAAiACsAIgBlAGwAbAAhACcAIgApAA==

PS C:\tmp\hayabusa-3.0.1-win-x64> .\hayabusa.exe extract-base64 --time-offset 1h -l -q
Start time: 2025/01/20 20:32
Total event log files: 369
Total file size: 107.2 MB

Loading detection rules. Please wait.

[00:00:01] 369 / 369   [========================================] 100%

Scanning finished.
                                                                                                                                                                                             ╭────────────────────────────────┬──────────┬───────────────────────────────────────────────────────────────────────┬───────────────────────────────────────────────────────────────────────╮
│            Timestamp           ┆ Computer ┆                             Base64 String                             ┆                             Decoded String                            │
╞════════════════════════════════╪══════════╪═══════════════════════════════════════════════════════════════════════╪═══════════════════════════════════════════════════════════════════════╡
│ 2025-01-20 20:20:04.244 +09:00 ┆ mouse    ┆ JgAgACgAZwBjAG0AIAAoACcAaQBlAHsAMAB9ACcAIAAtAGYAIAAnAHgAJwApACkAIAAoA ┆ & (gcm ('ie{0}' -f 'x')) ("Wr"+"it"+"e-H"+"ost 'H"+"el"+"lo, fr"+"om  │
│                                ┆          ┆ CIAVwByACIAKwAiAGkAdAAiACsAIgBlAC0ASAAiACsAIgBvAHMAdAAgACcASAAiACsAIg ┆ P"+"ow"+"erS"+"h"+"ell!'")                                            │
│                                ┆          ┆ BlAGwAIgArACIAbABvACwAIABmAHIAIgArACIAbwBtACAAUAAiACsAIgBvAHcAIgArACI ┆                                                                       │
│                                ┆          ┆ AZQByAFMAIgArACIAaAAiACsAIgBlAGwAbAAhACcAIgApAA                       ┆                                                                       │
├╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌┼╌╌╌╌╌╌╌╌╌╌┼╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌┼╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌┤
│ 2025-01-20 20:22:34.515 +09:00 ┆ mouse    ┆ JgAgACgAZwBjAG0AIAAoACcAaQBlAHsAMAB9ACcAIAAtAGYAIAAnAHgAJwApACkAIAAoA ┆ & (gcm ('ie{0}' -f 'x')) ("Wr"+"it"+"e-H"+"ost 'H"+"el"+"lo, fr"+"om  │
│                                ┆          ┆ CIAVwByACIAKwAiAGkAdAAiACsAIgBlAC0ASAAiACsAIgBvAHMAdAAgACcASAAiACsAIg ┆ P"+"ow"+"erS"+"h"+"ell!'")                                            │
│                                ┆          ┆ BlAGwAIgArACIAbABvACwAIABmAHIAIgArACIAbwBtACAAUAAiACsAIgBvAHcAIgArACI ┆                                                                       │
│                                ┆          ┆ AZQByAFMAIgArACIAaAAiACsAIgBlAGwAbAAhACcAIgApAA                       ┆                                                                       │
╰────────────────────────────────┴──────────┴───────────────────────────────────────────────────────────────────────┴───────────────────────────────────────────────────────────────────────╯
Elapsed time: 00:00:01.319

[YamatoSecurity]

@fukusuket LGTM! I tested it and works great! Thanks so much!