Cross-source coverage

T1027 / ATT&CK

Obfuscated Files or Information

895 rules · 883 families across 11 sources.

80 deprecated hidden · include

From MITRE ATT&CK 19.2

Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.

Payloads may be compressed, archived, or encrypted in order to avoid detection. These payloads may be used during Initial Access or later to mitigate detection. Sometimes a user's action may be required to open and Deobfuscate/Decode Files or Information for User Execution. The user may also be required to input a password to open a password protected compressed/encrypted file that was provided by the adversary. Adversaries may also use compressed or archived scripts, such as JavaScript.

Portions of files can also be encoded to hide the plain-text strings that would otherwise help defenders with discovery. Payloads may also be split into separate, seemingly benign files that only reveal malicious functionality when reassembled.

Adversaries may also abuse Command Obfuscation to obscure commands executed from payloads or directly via Command and Scripting Interpreter. Environment variables, aliases, characters, and other platform/language specific semantics can be used to evade signature based detections and application control mechanisms.

Tactics
Stealth
Platforms
ESXi · Linux · macOS · Network Devices · Windows
Telemetry
WinEventLog:SecurityWinEventLog:Sysmonauditd:SYSCALLlinux:climacos:unifiedlogmacos:osquerynetworkdevice:IDSesxi:vmkernelesxi:hostd

How MITRE says to detect it DET0378

Behavioral Detection of Obfuscated Files or Information

Windows Analytic 1064

Correlates script execution or suspicious parent processes with creation or modification of encoded, compressed, or encrypted file formats (e.g.,.zip,.7z,.enc) and abnormal command-line syntax or PowerShell obfuscation.

  • WinEventLog:Security EventCode=4688
  • WinEventLog:Sysmon EventCode=11
  • WinEventLog:Sysmon EventCode=1

Linux Analytic 1065

Detects use of gzip, base64, tar, or openssl in scripts or commands that encode/encrypt files after file staging or system enumeration.

  • auditd:SYSCALL execve
  • auditd:SYSCALL open, write
  • linux:cli Shell history logs

macOS Analytic 1066

Monitors use of archive or encryption tools (zip, openssl) tied to user-scripted activity or binaries writing encoded payloads under /Users or /Volumes.

  • macos:unifiedlog log stream --predicate 'processImagePath contains "zip" OR "base64"'
  • macos:osquery file_events

Network Devices Analytic 1067

Identifies transfer of base64, uuencoded, or high-entropy files over HTTP, FTP, or custom protocols in lateral movement or exfiltration streams.

  • networkdevice:IDS content inspection / PCAP / HTTP body

ESXi Analytic 1068

Detects encoded PowerCLI or Base64-encoded payloads staged via datastore uploads or shell access (e.g., ESXi Shell or backdoored VIBs).

  • esxi:vmkernel Datastore modification events
  • esxi:hostd Remote access API calls and file uploads

View on attack.mitre.org ↗

Sub-techniques with coverage

Counted in the 895 above — a rule tagged a sub-technique covers this technique too.

Emerging Threats Open

621 rules · 619 families
Detection Severity Format
ET ATTACK_RESPONSE Obfuscated Batch Script Inbound M1 2 variants High Suricata
ET ATTACK_RESPONSE Obfuscated Batch Script Inbound M2 2 variants High Suricata
ET ATTACK_RESPONSE VBA/Subdoc.B Obfuscated Payload Inbound High Suricata
ET EXPLOIT Apache Obfuscated log4j RCE Attempt (tcp ldap) (CVE-2021-44228) High Suricata
ET EXPLOIT_KIT Obfuscated LordEK Landing M1 2 variants High Suricata
ET EXPLOIT_KIT Obfuscated LordEK Landing M2 2 variants High Suricata
ET EXPLOIT_KIT Probable Sakura exploit kit landing page obfuscated applet tag Mar 1 2013 High Suricata
ET EXPLOIT_KIT Probable Sakura exploit kit landing page obfuscated applet tag Mar 28 2013 High Suricata
ET EXPLOIT_KIT Probable Sakura exploit kit landing page with obfuscated URLs High Suricata
ET EXPLOIT_KIT Probable Sakura Java applet with obfuscated URL Sep 21 2012 High Suricata

+ 611 more from Emerging Threats Open → showing the 10 highest-severity

SigmaHQ/sigma

125 rules
Detection Severity Format
Turla Group Commands May 2020 Critical Sigma
Base64 Encoded PowerShell Command Detected High Sigma
Binary Padding - Linux High Sigma
Binary Padding - MacOS High Sigma
Csc.EXE Execution Form Potentially Suspicious Parent High Sigma
File Decoded From Base64/Hex Via Certutil.EXE High Sigma
File In Suspicious Location Encoded To Base64 Via Certutil.EXE High Sigma
HackTool - CrackMapExec PowerShell Obfuscation High Sigma
Invoke-Obfuscation CLIP+ Launcher High Sigma
Invoke-Obfuscation CLIP+ Launcher - PowerShell High Sigma

+ 115 more from SigmaHQ/sigma → showing the 10 highest-severity

elastic/detection-rules

42 rules
Detection Severity Format
Base64 Decoded Payload Piped to Interpreter High Elastic TOML
Command Obfuscation via Unicode Modifier Letters High Elastic TOML
Decoded Payload Piped to Interpreter Detected via Defend for Containers High Elastic TOML
Long Base64 Encoded Command via Scripting Interpreter High Elastic TOML
Potential Antimalware Scan Interface Bypass via PowerShell High Elastic TOML
Potential PowerShell Obfuscation via Backtick-Escaped Variable Expansion High Elastic TOML
Potential PowerShell Obfuscation via Character Array Reconstruction High Elastic TOML
Potential PowerShell Obfuscation via Concatenated Dynamic Command Invocation High Elastic TOML
Potential PowerShell Obfuscation via String Concatenation High Elastic TOML
PowerShell Suspicious Payload Encoded and Compressed High Elastic TOML

+ 32 more from elastic/detection-rules → showing the 10 highest-severity

elastic/protections-artifacts

41 rules · 40 families
Detection Severity Format
AppleScript Decoded via Base64 Undefined Elastic TOML
Base64 Encoded String Execution via Osascript Undefined Elastic TOML
Base64 or Xxd Decode Argument Evasion Undefined Elastic TOML
Base64 Shebang Payload Decoded via Built-in Utility Undefined Elastic TOML
Command Obfuscation via Unicode Modifier Letters Undefined Elastic TOML
Data Encrypted and Archived 2 variants Undefined Elastic TOML
Data Encrypted and Archived 2 variants Undefined Elastic TOML
Decoded or Decrypted Payload Written to Suspicious Directory Undefined Elastic TOML
Decoded Payload Piped to Interpreter Undefined Elastic TOML
Embedded Payload Dropped and Executed Undefined Elastic TOML

+ 31 more from elastic/protections-artifacts → showing the 10 highest-severity

socfortress/Wazuh-Rules

30 rules · 22 families
Detection Severity Format
Adversaries may use binary padding to add junk data and change the on-disk representation of malware. This rule detect using dd and truncate to add a junk data to file. 4 variants High Wazuh XML
Adversaries may use binary padding to add junk data and change the on-disk representation of malware. This rule detect using dd and truncate to add a junk data to file. 4 variants High Wazuh XML
Adversaries may use binary padding to add junk data and change the on-disk representation of malware. This rule detect using dd and truncate to add a junk data to file. 4 variants High Wazuh XML
Adversaries may use binary padding to add junk data and change the on-disk representation of malware. This rule detect using dd and truncate to add a junk data to file. 4 variants High Wazuh XML
Compilation tool execution detected (gcc, g++, clang, clang++, go) - potential Compile After Delivery High Wazuh XML
Detects appending of zip file to image. 2 variants High Wazuh XML
Detects appending of zip file to image. 2 variants High Wazuh XML
Detects embeding of files with usage of steghide binary, the adversaries may use this technique to prevent the detection of hidden information. 2 variants High Wazuh XML
Detects embeding of files with usage of steghide binary, the adversaries may use this technique to prevent the detection of hidden information. 2 variants High Wazuh XML
Detects extracting of zip file from image file. 2 variants High Wazuh XML

+ 20 more from socfortress/Wazuh-Rules → showing the 10 highest-severity

splunk/security_content

21 rules
Detection Severity Format
Cisco Secure Firewall - Lumma Stealer Activity Undefined SPL
Cisco Secure Firewall - Repeated Malware Downloads Undefined SPL
Cisco Secure Firewall - Snort Rule Triggered Across Multiple Hosts Undefined SPL
CSC Net On The Fly Compilation Undefined SPL
Curl Execution with Percent Encoded URL Undefined SPL
Linux Decode Base64 to Shell Undefined SPL
Linux Obfuscated Files or Information Base64 Decode Undefined SPL
Linux Suspicious GCC Invocation Building Init Shared Object Undefined SPL
Malicious PowerShell Process - Encoded Command Undefined SPL
Powershell Creating Thread Mutex Undefined SPL

+ 11 more from splunk/security_content → showing the 10 highest-severity

Bert-JanP/Hunting-Queries-Detection-Rules

6 rules
Detection Severity Format
All Encoded Powershell Commands Undefined KQL
Encoded Powershell Commands That Have Potentially Performed Recon Activities Undefined KQL
Encoded Powershell Executions by Device Undefined KQL
MITRE ATT&CK Mapping Undefined KQL
Rare .lnk File Created on Desktop Undefined KQL
TTP Detection Rule: PowerShell -encodedcommand switch Undefined KQL

Wazuh Core Ruleset

4 rules
Detection Severity Format
Suspicious file created by Microsoft Office process: created · win.eventdata.image = (?i)(winword|excel|powerpnt|outlook)\.exe, win.eventdata.targetFilename = (?i)appdata\\\\.+\.lnk Critical Wazuh XML
Value added to registry key has Base64-like pattern High Wazuh XML
Powershell executed a creation or update of a WMI instance with encoded values Medium Wazuh XML
Powershell script compiling code using CSC.exe, possible malware drop Medium Wazuh XML

Azure/Azure-Sentinel

2 rules
Detection Severity Format
Base64 encoded Windows process command-lines (Normalized Process Events) Medium KQL
BadUSB LOLBIN execution via certutil (HID injection via Run dialog) Undefined KQL

chronicle/detection-rules

2 rules
Detection Severity Format
suspicious_file_downloaded_from_file_sharing_website_via_certutil_exe High YARA-L
suspicious_download_via_certutil_exe Medium YARA-L

panther-labs/panther-analysis

1 rule
Detection Severity Format
GitHub Workflow Downloading Artifacts Informational Panther Python

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.