T1027 Obfuscated Files or Information

About this technique

Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.

Payloads may be compressed, archived, or encrypted in order to avoid detection. These payloads may be used during Initial Access or later to mitigate detection. Sometimes a user's action may be required to open and Deobfuscate/Decode Files or Information for User Execution. The user may also be required to input a password to open a password protected compressed/encrypted file that was provided by the adversary. Adversaries may also use compressed or archived scripts, such as JavaScript.

Portions of files can also be encoded to hide the plain-text strings that would otherwise help defenders with discovery. Payloads may also be split into separate, seemingly benign files that only reveal malicious functionality when reassembled.

Adversaries may also abuse Command Obfuscation to obscure commands executed from payloads or directly via Command and Scripting Interpreter. Environment variables, aliases, characters, and other platform/language specific semantics can be used to evade signature based detections and application control mechanisms.

Detection rules136

Rules on DetectionCode tagged with T1027 or one of its sub-techniques.

Sigma115

Rule	Level	Log source	Technique
Base64 Encoded PowerShell Command Detected	high	windows / process_creation	T1027
Binary Padding - Linux	high	linux / NULL	T1027.001
Binary Padding - MacOS	high	macos / process_creation	T1027.001
Csc.EXE Execution Form Potentially Suspicious Parent	high	windows / process_creation	T1027.004
File Decoded From Base64/Hex Via Certutil.EXE	high	windows / process_creation	T1027
File In Suspicious Location Encoded To Base64 Via Certutil.EXE	high	windows / process_creation	T1027
HackTool - CrackMapExec PowerShell Obfuscation	high	windows / process_creation	T1027.005
Invoke-Obfuscation CLIP+ Launcher	high	windows / process_creation	T1027
Invoke-Obfuscation CLIP+ Launcher - PowerShell	high	windows / ps_script	T1027
Invoke-Obfuscation CLIP+ Launcher - PowerShell Module	high	windows / ps_module	T1027
Invoke-Obfuscation CLIP+ Launcher - Security	high	windows / NULL	T1027
Invoke-Obfuscation CLIP+ Launcher - System	high	windows / NULL	T1027
Invoke-Obfuscation Obfuscated IEX Invocation	high	windows / process_creation	T1027
Invoke-Obfuscation Obfuscated IEX Invocation - PowerShell	high	windows / ps_script	T1027
Invoke-Obfuscation Obfuscated IEX Invocation - PowerShell Module	high	windows / ps_module	T1027
Invoke-Obfuscation Obfuscated IEX Invocation - Security	high	windows / NULL	T1027
Invoke-Obfuscation Obfuscated IEX Invocation - System	high	windows / NULL	T1027
Invoke-Obfuscation STDIN+ Launcher	high	windows / process_creation	T1027
Invoke-Obfuscation STDIN+ Launcher - Powershell	high	windows / ps_script	T1027
Invoke-Obfuscation STDIN+ Launcher - PowerShell Module	high	windows / ps_module	T1027
Invoke-Obfuscation STDIN+ Launcher - Security	high	windows / NULL	T1027
Invoke-Obfuscation STDIN+ Launcher - System	high	windows / NULL	T1027
Invoke-Obfuscation VAR+ Launcher	high	windows / process_creation	T1027
Invoke-Obfuscation VAR+ Launcher - PowerShell	high	windows / ps_script	T1027
Invoke-Obfuscation VAR+ Launcher - PowerShell Module	high	windows / ps_module	T1027
Invoke-Obfuscation VAR+ Launcher - Security	high	windows / NULL	T1027
Invoke-Obfuscation VAR+ Launcher - System	high	windows / NULL	T1027
Invoke-Obfuscation VAR++ LAUNCHER OBFUSCATION	high	windows / process_creation	T1027
Invoke-Obfuscation VAR++ LAUNCHER OBFUSCATION - PowerShell	high	windows / ps_script	T1027
Invoke-Obfuscation VAR++ LAUNCHER OBFUSCATION - PowerShell Module	high	windows / ps_module	T1027
Invoke-Obfuscation VAR++ LAUNCHER OBFUSCATION - Security	high	windows / NULL	T1027
Invoke-Obfuscation VAR++ LAUNCHER OBFUSCATION - System	high	windows / NULL	T1027
Invoke-Obfuscation Via Stdin	high	windows / process_creation	T1027
Invoke-Obfuscation Via Stdin - Powershell	high	windows / ps_script	T1027
Invoke-Obfuscation Via Stdin - PowerShell Module	high	windows / ps_module	T1027
Invoke-Obfuscation Via Stdin - Security	high	windows / NULL	T1027
Invoke-Obfuscation Via Stdin - System	high	windows / NULL	T1027
Invoke-Obfuscation Via Use Clip	high	windows / process_creation	T1027
Invoke-Obfuscation Via Use Clip - Powershell	high	windows / ps_script	T1027
Invoke-Obfuscation Via Use Clip - PowerShell Module	high	windows / ps_module	T1027
Invoke-Obfuscation Via Use Clip - Security	high	windows / NULL	T1027
Invoke-Obfuscation Via Use Clip - System	high	windows / NULL	T1027
Invoke-Obfuscation Via Use MSHTA	high	windows / process_creation	T1027
Invoke-Obfuscation Via Use MSHTA - PowerShell	high	windows / ps_script	T1027
Invoke-Obfuscation Via Use MSHTA - PowerShell Module	high	windows / ps_module	T1027
Invoke-Obfuscation Via Use MSHTA - Security	high	windows / NULL	T1027
Invoke-Obfuscation Via Use MSHTA - System	high	windows / NULL	T1027
Invoke-Obfuscation Via Use Rundll32 - PowerShell	high	windows / ps_script	T1027
Invoke-Obfuscation Via Use Rundll32 - PowerShell Module	high	windows / ps_module	T1027
Invoke-Obfuscation Via Use Rundll32 - Security	high	windows / NULL	T1027
Invoke-Obfuscation Via Use Rundll32 - System	high	windows / NULL	T1027
Obfuscated PowerShell MSI Install via WindowsInstaller COM	high	windows / process_creation	T1027.010
Password Protected ZIP File Opened (Email Attachment)	high	windows / NULL	T1027
Password Protected ZIP File Opened (Suspicious Filenames)	high	windows / NULL	T1027
Ping Hex IP	high	windows / process_creation	T1027
Potential CommandLine Obfuscation Using Unicode Characters From Suspicious Image	high	windows / process_creation	T1027
Potential PowerShell Command Line Obfuscation	high	windows / process_creation	T1027
Potential PowerShell Obfuscation Via Reversed Commands	high	windows / process_creation	T1027
Potential PowerShell Obfuscation Via WCHAR/CHAR	high	windows / process_creation	T1027
Potential Winnti Dropper Activity	high	windows / file_event	T1027
PowerShell Base64 Encoded Invoke Keyword	high	windows / process_creation	T1027
PowerShell Base64 Encoded Reflective Assembly Load	high	windows / process_creation	T1027
PowerShell Base64 Encoded WMI Classes	high	windows / process_creation	T1027
Powershell Token Obfuscation - Powershell	high	windows / ps_script	T1027.009
Powershell Token Obfuscation - Process Creation	high	windows / process_creation	T1027.009
Process Execution From Shared Memory Directory	high	linux / process_creation	T1027.011
PUA - DefenderCheck Execution	high	windows / process_creation	T1027.005
Python One-Liners with Base64 Decoding	high	windows / process_creation	T1027.010
Python One-Liners with Base64 Decoding - Linux	high	linux / process_creation	T1027.010
Renamed AutoIt Execution	high	windows / process_creation	T1027
Suspicious Encoded And Obfuscated Reflection Assembly Load Function Call	high	windows / process_creation	T1027
Suspicious Explorer Process with Whitespace Padding - ClickFix/FileFix	high	windows / process_creation	T1027.010
Suspicious File Downloaded From Direct IP Via Certutil.EXE	high	windows / process_creation	T1027
Suspicious File Downloaded From File-Sharing Website Via Certutil.EXE	high	windows / process_creation	T1027
Suspicious File Encoded To Base64 Via Certutil.EXE	high	windows / process_creation	T1027
Suspicious Filename with Embedded Base64 Commands	high	linux / file_event	T1027
Suspicious Get-Variable.exe Creation	high	windows / file_event	T1027
Suspicious Space Characters in RunMRU Registry Path - ClickFix	high	windows / registry_set	T1027.010
Suspicious Space Characters in TypedPaths Registry Path - FileFix	high	windows / registry_set	T1027.010
Suspicious SYSTEM User Process Creation	high	windows / process_creation	T1027
Visual Basic Command Line Compiler Usage	high	windows / process_creation	T1027.004
Certificate Exported Via Certutil.EXE	medium	windows / process_creation	T1027
ConvertTo-SecureString Cmdlet Usage Via CommandLine	medium	windows / process_creation	T1027
Dynamic .NET Compilation Via Csc.EXE	medium	windows / process_creation	T1027.004
File Encoded To Base64 Via Certutil.EXE	medium	windows / process_creation	T1027
Findstr Launching .lnk File	medium	windows / process_creation	T1027.003
Invoke-Obfuscation COMPRESS OBFUSCATION	medium	windows / process_creation	T1027
Invoke-Obfuscation COMPRESS OBFUSCATION - PowerShell	medium	windows / ps_script	T1027
Invoke-Obfuscation COMPRESS OBFUSCATION - PowerShell Module	medium	windows / ps_module	T1027
Invoke-Obfuscation COMPRESS OBFUSCATION - Security	medium	windows / NULL	T1027
Invoke-Obfuscation COMPRESS OBFUSCATION - System	medium	windows / NULL	T1027
Invoke-Obfuscation RUNDLL LAUNCHER - PowerShell	medium	windows / ps_script	T1027
Invoke-Obfuscation RUNDLL LAUNCHER - PowerShell Module	medium	windows / ps_module	T1027
Invoke-Obfuscation RUNDLL LAUNCHER - Security	medium	windows / NULL	T1027
Invoke-Obfuscation RUNDLL LAUNCHER - System	medium	windows / NULL	T1027
Password Protected ZIP File Opened	medium	windows / NULL	T1027
Potential Application Whitelisting Bypass via Dnx.EXE	medium	windows / process_creation	T1027.004
Potential Obfuscated Ordinal Call Via Rundll32	medium	windows / process_creation	T1027.010
Potential Secure Deletion with SDelete	medium	windows / NULL	T1027.005
PUA - Potential PE Metadata Tamper Using Rcedit	medium	windows / process_creation	T1027 T1027.005
Suspicious Download Via Certutil.EXE	medium	windows / process_creation	T1027
Suspicious Usage of For Loop with Recursive Directory Search in CMD	medium	windows / process_creation	T1027.010
Suspicious XOR Encoded PowerShell Command	medium	windows / process_creation	T1027
Decode Base64 Encoded Text	low	linux / process_creation	T1027
Decode Base64 Encoded Text -MacOs	low	macos / process_creation	T1027
Dynamic CSharp Compile Artefact	low	windows / file_event	T1027.004
Potential Encoded PowerShell Patterns In CommandLine	low	windows / process_creation	T1027
Potential PowerShell Obfuscation Using Alias Cmdlets	low	windows / ps_script	T1027
Potential PowerShell Obfuscation Using Character Join	low	windows / ps_script	T1027
Python Image Load By Non-Python Process	low	windows / image_load	T1027.002
Steganography Extract Files with Steghide	low	linux / NULL	T1027.003
Steganography Hide Files with Steghide	low	linux / NULL	T1027.003
Steganography Hide Zip Information in Picture File	low	linux / NULL	T1027.003
Steganography Unzip Hidden Information From Picture File	low	linux / NULL	T1027.003
Failed Code Integrity Checks	informational	windows / NULL	T1027.001

Splunk21

Rule	Type	Risk	Data source	Technique
Cisco Secure Firewall - Lumma Stealer Activity	TTP	NULL	Cisco Secure Firewall Threat Defense Intrusion Event	T1027
Cisco Secure Firewall - Repeated Malware Downloads	Anomaly	NULL	Cisco Secure Firewall Threat Defense File Event	T1027
Cisco Secure Firewall - Snort Rule Triggered Across Multiple Hosts	Anomaly	NULL	Cisco Secure Firewall Threat Defense Intrusion Event	T1027
CSC Net On The Fly Compilation	Hunting	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2	T1027.004
Curl Execution with Percent Encoded URL	Anomaly	NULL	CrowdStrike ProcessRollup2, Sysmon EventID 1, Sysmon for Linux EventID 1, Windows Event Log Security 4688	T1027
Linux Decode Base64 to Shell	TTP	NULL	Sysmon for Linux EventID 1, Cisco Isovalent Process Exec	T1027
Linux Obfuscated Files or Information Base64 Decode	Anomaly	NULL	Sysmon for Linux EventID 1	T1027
Linux Suspicious GCC Invocation Building Init Shared Object	TTP	NULL	Sysmon for Linux EventID 1	T1027.004
Malicious PowerShell Process - Encoded Command	Hunting	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2	T1027
Powershell Creating Thread Mutex	TTP	NULL	Powershell Script Block Logging 4104	T1027.005
Powershell Enable SMB1Protocol Feature	TTP	NULL	Powershell Script Block Logging 4104	T1027.005
Powershell Fileless Script Contains Base64 Encoded Content	TTP	NULL	Powershell Script Block Logging 4104	T1027
PowerShell WebRequest Using Memory Stream	TTP	NULL	Powershell Script Block Logging 4104	T1027.011
Wermgr Process Create Executable File	TTP	NULL	Sysmon EventID 11	T1027
Windows Command Obfuscation with Environment Variable Substrings	Anomaly	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2	T1027.010
Windows Njrat Fileless Storage via Registry	TTP	NULL	Sysmon EventID 13	T1027.011
Windows Obfuscated Files or Information via RAR SFX	Anomaly	NULL	Sysmon EventID 11	T1027.013
Windows PowerShell Process Implementing Manual Base64 Decoder	Anomaly	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2	T1027.010
Windows Registry Payload Injection	TTP	NULL	Sysmon EventID 13	T1027.011
Windows Snake Malware File Modification Crmlog	TTP	NULL	Sysmon EventID 11	T1027
Windows TinyCC Shellcode Execution	TTP	NULL	Sysmon EventID 1, Windows Event Log Security 4688	T1027

Sub-techniques18

ID	Name	Examples
T1027.001	Binary Padding	30
T1027.002	Software Packing	103
T1027.003	Steganography	31
T1027.004	Compile After Delivery	10
T1027.005	Indicator Removal from Tools	18
T1027.006	HTML Smuggling	3
T1027.007	Dynamic API Resolution	20
T1027.008	Stripped Payloads	2
T1027.009	Embedded Payloads	24
T1027.010	Command Obfuscation	70
T1027.011	Fileless Storage	31
T1027.012	LNK Icon Smuggling	4
T1027.013	Encrypted/Encoded File	248
T1027.014	Polymorphic Code	1
T1027.015	Compression	35
T1027.016	Junk Code Insertion	24
T1027.017	SVG Smuggling	0
T1027.018	Invisible Unicode	1

Groups18

Software138

Show 114 more

COATHANGER Cobalt Strike CoinTicker Comnie ComRAT Conficker Conti CORESHELL Cuba DarkGate DarkTortilla Daserf Denis Diavol DRATzarus Dridex Drovorub DustySky Ebury ECCENTRICBANDWAGON Ecipekac EKANS Epic FatDuke Final1stspy FinFisher Flagpro Fooder Gootloader Green Lambert GrimAgent H1N1 Hancitor HTTPBrowser HTTPTroy Hydraq Imminent Monitor Industroyer InnaputRAT InvisiMole ISMInjector JPIN jRAT Kazuar KillDisk Kobalos Lizar LODEINFO Lokibot Lumma Stealer Matryoshka Maze MCMD MiniDuke NanoCore NETWIRE NightClub NOKKI NOOPLDR OLDBAIT OopsIE Orz Out1 P.A.S. Webshell Pillowmint Pisloader PlugX PoetRAT PoisonIvy PolyglotDuke POSHSPY PowerStallion PUBLOAD PUNCHBUGGY PUNCHTRACK QakBot Ramsay Raspberry Robin RegDuke Remcos ROKRAT RTM RustyWater Ryuk Saint Bot Samurai Sardonic SDBbot ShadowPad Shai-Hulud Shamoon ShimRatReporter SHOTPUT Siloscape Sliver SLOWPULSE Small Sieve Snip3 SodaMaster SombRAT SoreFang StreamEx StrelaStealer SUNBURST SUNSPOT SVCReady SynAck TajMahal TEARDROP TrickBot Trojan.Karagany Turian Valak XTunnel

Campaigns4

2016 Ukraine Electric Power Attack 3CX Supply Chain Attack C0015 C0017

Procedure examples160

Groups18

Used by	Procedure example
GroupAPT-C-36	APT-C-36 has used ConfuserEx to obfuscate its variant of Imminent Monitor, compressed payloads and RAT packages, and password protected encrypted email attachments to avoid detection. APT-C-36 has also compressed initial droppers into ZIP, LHA and UUE formats. Kaspersky BlindEagle AUG 2024 QiAnXin APT-C-36 Feb2019
GroupAPT3	APT3 obfuscates files or information to help evade defensive measures. Symantec Buckeye
GroupAPT37	APT37 obfuscates strings and payloads. Securelist ScarCruft May 2019 Talos Group123 Volexity InkySquid RokRAT August 2021
GroupAPT41	APT41 used VMProtected binaries in multiple intrusions. FireEye APT41 March 2020
GroupBackdoorDiplomacy	BackdoorDiplomacy has obfuscated tools and malware it uses with VMProtect. ESET BackdoorDiplomacy Jun 2021
GroupBlackOasis	BlackOasis's first stage shellcode contains a NOP sled with alternative instructions that was likely designed to bypass antivirus tools. Securelist BlackOasis Oct 2017
GroupEarth Lusca	Earth Lusca used Base64 to encode strings. TrendMicro EarthLusca 2022
GroupGALLIUM	GALLIUM used a modified version of HTRAN in which they obfuscated strings such as debug messages in an apparent attempt to evade detection. Cybereason Soft Cell June 2019

View all 18 groups examples

Software138

Used by	Procedure example
MalwareAction RAT	Action RAT's commands, strings, and domains can be Base64 encoded within the payload. MalwareBytes SideCopy Dec 2021
MalwareADVSTORESHELL	Most of the strings in ADVSTORESHELL are encrypted with an XOR-based algorithm; some strings are also encrypted with 3DES and reversed. API function names are also reversed, presumably to avoid detection in memory. Bitdefender APT28 Dec 2015 Kaspersky Sofacy
MalwareAgent Tesla	Agent Tesla has had its code obfuscated in an apparent attempt to make analysis difficult. Agent Tesla has used the Rijndael symmetric encryption algorithm to encrypt strings. Fortinet Agent Tesla April 2018 Malwarebytes Agent Tesla April 2020
MalwareAmadey	Amadey has obfuscated strings such as antivirus vendor names, domains, files, and others. BlackBerry Amadey 2020
MalwareAnchor	Anchor has obfuscated code with stack strings and string encryption. Cyberreason Anchor December 2019
MalwareANELLDR	ANELLDR code implements anti-analysis techniques including control flow flattening and Mixed Boolean Arithmetic (MBA). Trend Micro Earth Kasha Anel NOV 2024
MalwareAppleJeus	AppleJeus has XOR-encrypted collected system information prior to sending to a C2. AppleJeus has also used the open source ADVObfuscation library for its components. CISA AppleJeus Feb 2021
MalwareAppleSeed	AppleSeed has the ability to Base64 encode its payload and custom encrypt API calls. Malwarebytes Kimsuky June 2021

View all 138 software examples

Campaigns4

Used by	Procedure example
Campaign2016 Ukraine Electric Power Attack	During the 2016 Ukraine Electric Power Attack, Sandworm Team used heavily obfuscated code with Industroyer in its Windows Notepad backdoor. ESET Industroyer
Campaign3CX Supply Chain Attack	During the 3CX Supply Chain Attack, AppleJeus payloads use AES-256 GCM cipher to encrypt data to include ICONICSTEALER and VEILEDSIGNAL. Mandiant 3cx UNC4736 2023 Volexity 3CX Supply Chain Compromise AppleJeus IconicStealer March 2023
CampaignC0015	During C0015, the threat actors used Base64-encoded strings. DFIR Conti Bazar Nov 2021
CampaignC0017	During C0017, APT41 broke malicious binaries, including DEADEYE and KEYPLUG, into multiple sections on disk to evade detection. Mandiant APT41

References6

Carbon Black Obfuscation Sept 2016 Open source
Tedesco, B. (2016, September 23). Security Alert Summary. Retrieved February 12, 2018.
FireEye Obfuscation June 2017 Open source
Bohannon, D. & Carr N. (2017, June 30). Obfuscation in the Wild: Targeted Attackers Lead the Way in Evasion Techniques. Retrieved February 12, 2018.
FireEye Revoke-Obfuscation July 2017 Open source
Bohannon, D. & Holmes, L. (2017, July 27). Revoke-Obfuscation: PowerShell Obfuscation Detection Using Science. Retrieved November 17, 2024.
Linux/Cdorked.A We Live Security Analysis Open source
Pierre-Marc Bureau. (2013, April 26). Linux/Cdorked.A: New Apache backdoor being used in the wild to serve Blackhole. Retrieved September 10, 2017.
PaloAlto EncodedCommand March 2017 Open source
White, J. (2017, March 10). Pulling Back the Curtains on EncodedCommand PowerShell Attacks. Retrieved February 12, 2018.
Volexity PowerDuke November 2016 Open source
Adair, S.. (2016, November 9). PowerDuke: Widespread Post-Election Spear Phishing Campaigns Targeting Think Tanks and NGOs. Retrieved January 11, 2017.