Cross-source coverage

T1027.010 / ATT&CK

Obfuscated Files or Information: Command Obfuscation

37 rules · 36 families across 5 sources.

1 deprecated hidden · include

From MITRE ATT&CK 19.2

Adversaries may obfuscate content during command execution to impede detection. Command-line obfuscation is a method of making strings and patterns within commands and scripts more difficult to signature and analyze. This type of obfuscation can be included within commands executed by delivered payloads (e.g., Phishing and Drive-by Compromise) or interactively via Command and Scripting Interpreter.

For example, adversaries may abuse syntax that utilizes various symbols and escape characters (such as spacing, ^, +. $, and %) to make commands difficult to analyze while maintaining the same intended functionality. Many languages support built-in obfuscation in the form of base64 or URL encoding. Adversaries may also manually implement command obfuscation via string splitting (“Wor”+“d.Application”), order and casing of characters (rev <<<'dwssap/cte/ tac'), globing (mkdir -p '/tmp/:&$NiA'), as well as various tricks involving passing strings through tokens/environment variables/input streams.

Adversaries may also use tricks such as directory traversals to obfuscate references to the binary being invoked by a command (C:\voi\pcw\..\..\Windows\tei\qs\k\..\..\..\system32\erool\..\wbem\wg\je\..\..\wmic.exe shadowcopy delete).

Tools such as Invoke-Obfuscation and Invoke-DOSfucation have also been used to obfuscate commands.

Tactics: Stealth
Platforms: Linux · macOS · Windows
Telemetry: WinEventLog:Securityauditd:SYSCALLlinux:osquerymacos:unifiedlogmacos:endpointsecurity

How MITRE says to detect it DET0505

Detection Strategy for Command Obfuscation

Windows Analytic 1394

Detection of command-line activity exhibiting syntactic obfuscation patterns, such as excessive escape characters, base64 encoding, command concatenation, or outlier command length and entropy.

WinEventLog:Security EventCode=4688

Linux Analytic 1395

Detection of shell commands that leverage encoded execution, command chaining, excessive piping, or unusual token patterns indicative of obfuscation.

auditd:SYSCALL execve
linux:osquery process_events.command_line

macOS Analytic 1396

Detection of obfuscated commands via shell, osascript, or AppleScript interpreters using unusual tokens, encoding, variable substitution, or runtime string reconstruction.

macos:unifiedlog process:spawn, process:exec
macos:endpointsecurity ES_EVENT_TYPE_NOTIFY_EXEC

View on attack.mitre.org ↗

elastic/detection-rules

22 rules

Detection	Severity	Format
Command Obfuscation via Unicode Modifier Letters	High	Elastic TOML
Decoded Payload Piped to Interpreter Detected via Defend for Containers	High	Elastic TOML
Potential Antimalware Scan Interface Bypass via PowerShell	High	Elastic TOML
Potential PowerShell Obfuscation via Backtick-Escaped Variable Expansion	High	Elastic TOML
Potential PowerShell Obfuscation via Character Array Reconstruction	High	Elastic TOML
Potential PowerShell Obfuscation via Concatenated Dynamic Command Invocation	High	Elastic TOML
Potential PowerShell Obfuscation via String Concatenation	High	Elastic TOML
Suspicious Execution with NodeJS	High	Elastic TOML
Command Line Obfuscation via Whitespace Padding	Medium	Elastic TOML
Multi-Base64 Decoding Attempt from Suspicious Location	Medium	Elastic TOML

+ 12 more from elastic/detection-rules → showing the 10 highest-severity

SigmaHQ/sigma

10 rules

Detection	Severity	Format
Obfuscated PowerShell MSI Install via WindowsInstaller COM	High	Sigma
Python One-Liners with Base64 Decoding	High	Sigma
Python One-Liners with Base64 Decoding - Linux	High	Sigma
Suspicious Explorer Process with Whitespace Padding - ClickFix/FileFix	High	Sigma
Suspicious Space Characters in RunMRU Registry Path - ClickFix	High	Sigma
Suspicious Space Characters in TypedPaths Registry Path - FileFix	High	Sigma
Invocation Of Crypto-Classes From The "Cryptography" PowerShell Namespace	Medium	Sigma
Potential Obfuscated Ordinal Call Via Rundll32	Medium	Sigma
Registry Set With Crypto-Classes From The "Cryptography" PowerShell Namespace	Medium	Sigma
Suspicious Usage of For Loop with Recursive Directory Search in CMD	Medium	Sigma

Bert-JanP/Hunting-Queries-Detection-Rules

2 rules

Detection	Severity	Format
MITRE ATT&CK Mapping	Undefined	KQL
TTP Detection Rule: PowerShell -encodedcommand switch	Undefined	KQL

splunk/security_content

2 rules

Detection	Severity	Format
Windows Command Obfuscation with Environment Variable Substrings	Undefined	SPL
Windows PowerShell Process Implementing Manual Base64 Decoder	Undefined	SPL

elastic/protections-artifacts

1 rule

Detection	Severity	Format
Command Obfuscation via Unicode Modifier Letters	Undefined	Elastic TOML