T1027
Obfuscated Files or Information
ESXi · Linux · macOS · Network Devices · Windows5 pieces on this siteT1027 on attack.mitre.org
Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses. Payloads may be compressed, archived, or encrypted in order to avoid detection. These payloads may be used during Initial Access or later to mitigate detection.
Detect it
Hunts and rules you can run, each stating what it needs and what else it returns.
YARA triage samples: five heuristic rules for a web root, a script directory or a triage collection
Request-fed web shells in PHP and ASP.NET, PowerShell that decodes, executes and reaches the network in one file, ransom notes, and LSASS minidumps left on disk. Hunting rules that produce files to open, not verdicts.
Find obfuscated or downloading script blocks without drowning in administrative PowerShell.
The evidence it leaves
Where the traces live, and what each source proves and does not.
PowerShell script block logging (4104)
Read
Analyses, case studies, guides, references and interview questions.
Emulating T1059.001 until the detection actually fires
Four variants of the same PowerShell technique, three of which walked past a rule that looked fine on paper. Notes from a purple team afternoon.
PowerShell -EncodedCommand to readable script
The two operations that turn the base64 after -e, -enc or -EncodedCommand into the script that ran. Short, and the one you will use most.
how MITRE says to see it
Behavioral Detection of Obfuscated Files or Information
- Correlates script execution or suspicious parent processes with creation or modification of encoded, compressed, or encrypted file formats (e.g.,.zip,.7z,.enc) and abnormal command-line syntax or PowerShell obfuscation.
- Detects use of gzip, base64, tar, or openssl in scripts or commands that encode/encrypt files after file staging or system enumeration.
- Monitors use of archive or encryption tools (zip, openssl) tied to user-scripted activity or binaries writing encoded payloads under /Users or /Volumes.
- Identifies transfer of base64, uuencoded, or high-entropy files over HTTP, FTP, or custom protocols in lateral movement or exfiltration streams.
what reduces it
- M1017 User Training. Ensure that a finite amount of ingress points to a software deployment system exist with restricted access for those required to allow and enable newly deployed software.
- M1040 Behavior Prevention on Endpoint. On Windows 10+, enable Attack Surface Reduction (ASR) rules to prevent execution of potentially obfuscated payloads.
- M1049 Antivirus/Antimalware. Anti-virus can be used to automatically detect and quarantine suspicious files. Consider utilizing the Antimalware Scan Interface (AMSI) on Windows 10+ to analyze commands after being processed/interpreted.
- M1047 Audit. Consider periodic review of common fileless storage locations (such as the Registry or WMI repository) to potentially identify abnormal and malicious data.
sub-techniques
- T1027.001 Binary Padding
- T1027.002 Software Packing
- T1027.003 Steganography
- T1027.004 Compile After Delivery
- T1027.005 Indicator Removal from Tools
- T1027.006 HTML Smuggling
- T1027.007 Dynamic API Resolution
- T1027.008 Stripped Payloads
- T1027.009 Embedded Payloads
- T1027.010 Command Obfuscation
- T1027.011 Fileless Storage
- T1027.012 LNK Icon Smuggling
- T1027.013 Encrypted/Encoded File
- T1027.014 Polymorphic Code
- T1027.015 Compression
- T1027.016 Junk Code Insertion
- T1027.017 SVG Smuggling
- T1027.018 Invisible Unicode