T1027.010sub-technique of T1027 Obfuscated Files or Information

Command Obfuscation

Linux · macOS · Windows1 piece on this siteT1027.010 on attack.mitre.org

Adversaries may obfuscate content during command execution to impede detection. Command-line obfuscation is a method of making strings and patterns within commands and scripts more difficult to signature and analyze. This type of obfuscation can be included within commands executed by delivered payloads (e.g., Phishing and Drive-by Compromise) or interactively via Command and Scripting Interpreter.
MITRE ATT&CK 19.2, retrieved 2026-09-12

Read

Analyses, case studies, guides, references and interview questions.

RecipeCONSTRUCTED

PowerShell -EncodedCommand to readable script

The two operations that turn the base64 after -e, -enc or -EncodedCommand into the script that ran. Short, and the one you will use most.

T1027.010

how MITRE says to see it

Detection Strategy for Command Obfuscation

Detection of command-line activity exhibiting syntactic obfuscation patterns, such as excessive escape characters, base64 encoding, command concatenation, or outlier command length and entropy.
Detection of shell commands that leverage encoded execution, command chaining, excessive piping, or unusual token patterns indicative of obfuscation.
Detection of obfuscated commands via shell, osascript, or AppleScript interpreters using unusual tokens, encoding, variable substitution, or runtime string reconstruction.

what reduces it

M1040 Behavior Prevention on Endpoint. On Windows 10+, enable Attack Surface Reduction (ASR) rules to block execution of potentially obfuscated scripts.
M1049 Antivirus/Antimalware. Consider utilizing the Antimalware Scan Interface (AMSI) on Windows 10+ to analyze commands after being processed/interpreted.

the rest of T1027

T1027.001 Binary Padding · not covered yet
T1027.002 Software Packing · not covered yet
T1027.003 Steganography · not covered yet
T1027.004 Compile After Delivery · not covered yet
T1027.005 Indicator Removal from Tools · not covered yet
T1027.006 HTML Smuggling · not covered yet
T1027.007 Dynamic API Resolution · not covered yet
T1027.008 Stripped Payloads · not covered yet
T1027.009 Embedded Payloads · not covered yet
T1027.011 Fileless Storage · not covered yet
T1027.012 LNK Icon Smuggling · not covered yet
T1027.013 Encrypted/Encoded File · not covered yet
T1027.014 Polymorphic Code · not covered yet
T1027.015 Compression · not covered yet
T1027.016 Junk Code Insertion · not covered yet
T1027.017 SVG Smuggling · not covered yet
T1027.018 Invisible Unicode · not covered yet

The description, detection analytics and mitigations are reproduced from MITRE ATT&CK, version 19.2, under its terms of use. The checklists, hunts, labs and everything else linked here are this site’s.