Security ArtifactsDFIR Intelligence
SearchSign inSubscribe

T1027.013sub-technique of T1027 Obfuscated Files or Information

Encrypted/Encoded File

Linux · macOS · Windowsnothing on this site yetT1027.013 on attack.mitre.org

Adversaries may encrypt or encode files to obfuscate strings, bytes, and other specific patterns to impede detection. Encrypting and/or encoding file content aims to conceal malicious artifacts within a file used in an intrusion. Many other techniques, such as Software Packing, Steganography, and Embedded Payloads, share this same broad objective.

MITRE ATT&CK 19.2, retrieved 2026-09-12

how MITRE says to see it

Encrypted or Encoded File Payload Detection Strategy

  • Detection of processes that load or decode encrypted/encoded files in memory and subsequently execute or inject them, indicating payload unpacking or memory-resident malware.
  • Detection of suspicious use of shell utilities or scripts that decode or decrypt a payload and execute it without writing to disk.
  • Detection of encoded payloads being decoded and executed in-memory using scripting tools or third-party decoders.

what reduces it

  • M1040 Behavior Prevention on Endpoint. On Windows 10+, enable Attack Surface Reduction (ASR) rules to block execution of potentially obfuscated scripts. Security tools should be configured to analyze the encoding properties of files and detect anomalies that deviate from standard encoding practices.
  • M1049 Antivirus/Antimalware. Anti-virus can be used to automatically detect and quarantine suspicious files, including those with high entropy measurements or with otherwise potentially malicious signs of obfuscation.

the rest of T1027

The description, detection analytics and mitigations are reproduced from MITRE ATT&CK, version 19.2, under its terms of use. The checklists, hunts, labs and everything else linked here are this site’s.