Cross-source coverage
T1140 / ATT&CK
Deobfuscate/Decode Files or Information
94 rules across 9 sources.
10 deprecated hidden · include
From MITRE ATT&CK 19.2
Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
One such example is the use of certutil to decode a remote access tool portable executable file that has been hidden inside a certificate file. Another example is using the Windows copy /b or type command to reassemble binary fragments into a malicious payload.
Sometimes a user's action may be required to open it for deobfuscation or decryption as part of User Execution. The user may also be required to input a password to open a password protected compressed/encrypted file that was provided by the adversary.
- Tactics
- Stealth
- Platforms
- ESXi · Linux · macOS · Windows
- Telemetry
-
WinEventLog:Sysmonauditd:SYSCALLmacos:unifiedlog
How MITRE says to detect it DET0275
Detect Adversary Deobfuscation or Decoding of Files and Payloads
Windows Analytic 0767
An adversary leverages built-in tools such as certutil.exe, powershell.exe, or copy.exe to decode, reassemble, or extract hidden malicious content from obfuscated containers or encoded formats. The decoding utility often spawns shortly after file staging or download and may be chained with script interpreters or further payload execution.
WinEventLog:SysmonEventCode=1WinEventLog:SysmonEventCode=11WinEventLog:SysmonEventCode=10
Linux Analytic 0768
The adversary uses native utilities like base64, gzip, tar, or openssl to decode, decompress, or decrypt files that were previously staged or downloaded. These tools may be chained with curl/wget and executed via bash/zsh, often to extract an embedded payload or reverse shell script.
auditd:SYSCALLbash/zsh of base64, tar, gzip, or openssl immediately after file write
macOS Analytic 0769
The adversary invokes built-in scripting or decoding tools like base64, plutil, or AppleScript-based utilities to decode files embedded in staging artifacts. Decoding often occurs post-download or as part of post-exploitation payload deployment via zsh, python, or osascript.
macos:unifiedlogbase64 -d or osascript invoked on staged file
elastic/detection-rules
36 rules| Detection | Severity | Format |
|---|---|---|
| Base64 Decoded Payload Piped to Interpreter | High | Elastic TOML |
| Decoded Payload Piped to Interpreter Detected via Defend for Containers | High | Elastic TOML |
| Long Base64 Encoded Command via Scripting Interpreter | High | Elastic TOML |
| Potential PowerShell Obfuscation via Backtick-Escaped Variable Expansion | High | Elastic TOML |
| Potential PowerShell Obfuscation via Character Array Reconstruction | High | Elastic TOML |
| Potential PowerShell Obfuscation via Concatenated Dynamic Command Invocation | High | Elastic TOML |
| Potential PowerShell Obfuscation via String Concatenation | High | Elastic TOML |
| PowerShell Suspicious Payload Encoded and Compressed | High | Elastic TOML |
| Suspicious Echo or Printf Execution Detected via Defend for Containers | High | Elastic TOML |
| Suspicious Execution from Foomatic-rip or Cupsd Parent | High | Elastic TOML |
+ 26 more from elastic/detection-rules → showing the 10 highest-severity
elastic/protections-artifacts
22 rules| Detection | Severity | Format |
|---|---|---|
| AppleScript Decoded via Base64 | Undefined | Elastic TOML |
| Base64 Encoded String Execution via Osascript | Undefined | Elastic TOML |
| Base64 or Xxd Decode Argument Evasion | Undefined | Elastic TOML |
| Base64 Shebang Payload Decoded via Built-in Utility | Undefined | Elastic TOML |
| Decoded or Decrypted Payload Written to Suspicious Directory | Undefined | Elastic TOML |
| Decoded Payload Piped to Interpreter | Undefined | Elastic TOML |
| Executable File Creation via Base64 | Undefined | Elastic TOML |
| Execution of a File Dropped by OpenSSL | Undefined | Elastic TOML |
| Initial Access or Execution via Microsoft Office Application | Undefined | Elastic TOML |
| Linux Payload Decoded and Decrypted via Built-in Utility | Undefined | Elastic TOML |
+ 12 more from elastic/protections-artifacts → showing the 10 highest-severity
SigmaHQ/sigma
18 rules| Detection | Severity | Format |
|---|---|---|
| Base64 Encoded PowerShell Command Detected | High | Sigma |
| MSHTA Execution with Suspicious File Extensions | High | Sigma |
| Ping Hex IP | High | Sigma |
| Potential Base64 Decoded From Images | High | Sigma |
| Potential BlackByte Ransomware Activity | High | Sigma |
| PowerShell Base64 Encoded FromBase64String Cmdlet | High | Sigma |
| Suspicious Inbox Manipulation Rules | High | Sigma |
| UNC4841 - Download Compressed Files From Temp.sh Using Wget | High | Sigma |
| UNC4841 - Download Tar File From Untrusted Direct IP Via Wget | High | Sigma |
| UNC4841 - SSL Certificate Exfiltration Via Openssl | High | Sigma |
+ 8 more from SigmaHQ/sigma → showing the 10 highest-severity
Wazuh Core Ruleset
6 rules| Detection | Severity | Format |
|---|---|---|
| CertUtil.exe used to decode binary file | Critical | Wazuh XML |
| Masqueraded CertUtil.exe used to decode binary file | Critical | Wazuh XML |
| Masqueraded CertUtil.exe with a different file name. Possible use to decode malware | Critical | Wazuh XML |
| Powershell script may be using Base64 decoding method | High | Wazuh XML |
| Powershell executing certutil to decode a file | Medium | Wazuh XML |
| Certutil decoding a file | Low | Wazuh XML |
socfortress/Wazuh-Rules
6 rules| Detection | Severity | Format |
|---|---|---|
| Deobfuscation or decoding activity detected — possible adversary behavior (T1140) | High | Wazuh XML |
| Shell launched from decoding utility — suspicious execution chain (T1140) | High | Wazuh XML |
| Sysmon - Event 1: Process creation · Certutil Decode (T1140) | High | Wazuh XML |
| Sysmon - Event 1: Process creation · Certutil Encode (T1140) | High | Wazuh XML |
| Sysmon - Event 1: Process creation · Renamed Certutil Encode (T1140) | High | Wazuh XML |
| Sysmon - Event 1: Process creation · Renamed Certutil Usage (T1140) | High | Wazuh XML |
Azure/Azure-Sentinel
2 rules| Detection | Severity | Format |
|---|---|---|
| A host is potentially running PowerShell to send HTTP(S) requests (ASIM Web Session schema) | Medium | KQL |
| Base64 encoded Windows process command-lines (Normalized Process Events) | Medium | KQL |
splunk/security_content
2 rules| Detection | Severity | Format |
|---|---|---|
| CertUtil With Decode Argument | Undefined | SPL |
| Linux Auditd Base64 Decode Files | Undefined | SPL |
Emerging Threats Open
1 rule| Detection | Severity | Format |
|---|---|---|
| ET MALWARE PLATINUM Steganographic HTTP Response Page Inbound | High | Suricata |
chronicle/detection-rules
1 rule| Detection | Severity | Format |
|---|---|---|
| mitre_attack_T1140_encoded_powershell_command | Informational | YARA-L |