T1027 · Obfuscated Files or Information

Sunturai

Detections can measure how the public catalogue is used — which detections people look for, and which pages bring them here. It sets a cookie that recognises this browser for 180 days. It is never linked to an account and never follows you to other sites. Privacy notice

T1027 · Obfuscated Files or Information · Sunturai

attack-patternenterprise-attackT1027

Obfuscated Files or Information

attack-pattern--b3d682b6-98f2-4fb0-aa3b-b4df007ca70a

Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses. Payloads may be compressed, archived, or encrypted in order to avoid detection. These payloads may be used during Initial Access or later to mitigate detection. Sometimes a user's action may be required to open and Deobfuscate/Decode Files or Information for User Execution. The user may also be required to input a password to open a password protected compressed/encrypted file that was provided by the adversary.(Citation: Volexity PowerDuke November 2016) Adversaries may also use compressed or archived scripts, such as JavaScript. Portions of files can also be encoded to hide the plain-text strings that would otherwise help defenders with discovery.(Citation: Linux/Cdorked.A We Live Security Analysis) Payloads may also be split into separate, seemingly benign files that only reveal malicious functionality when reassembled.(Citation: Carbon Black Obfuscation Sept 2016) Adversaries may also abuse Command Obfuscation to obscure commands executed from payloads or directly via Command and Scripting Interpreter. Environment variables, aliases, characters, and other platform/language specific semantics can be used to evade signature based detections and application control mechanisms.(Citation: FireEye Obfuscation June 2017) (Citation: FireEye Revoke-Obfuscation July 2017) (Citation: PaloAlto EncodedCommand March 2017)

Created: May 31, 2017, 9:30 PM UTC
Modified: May 12, 2026, 3:12 PM UTC

18 sub-techniques under this technique

Each is its own technique in the catalogue, with its own detections.

177 published detections cover this technique

Every one carries the source it came from and the licence it was published under.

Detections covering this technique
Detection	Severity	Source	Published	Licence
Windows Snake Malware File Modification Crmlog	Medium	Splunk security content	Oct 13, 2026	Apache License 2.0
Malicious PowerShell Process - Encoded Command	Medium	Splunk security content	Oct 13, 2026	Apache License 2.0
Linux Obfuscated Files or Information Base64 Decode	Informational	Splunk security content	Oct 13, 2026	Apache License 2.0
Linux Decode Base64 to Shell	Medium	Splunk security content	Oct 13, 2026	Apache License 2.0
Long Base64 Encoded Command via Scripting Interpreter	High	Elastic detection rules	Oct 9, 2026	Elastic License 2.0
PowerShell Dynamic Module Invocation Via ExportedCommands Array Index - PS Script	Medium	SigmaHQ	Oct 7, 2026	Detection Rule License 1.1
Cisco Secure Firewall - Repeated Malware Downloads	Informational	Splunk security content	Oct 6, 2026	Apache License 2.0
PowerShell Obfuscation via Negative Index String Reversal	Low	Elastic detection rules	Oct 6, 2026	Elastic License 2.0
Potential Hex Payload Execution via Common Utility	Low	Elastic detection rules	Oct 6, 2026	Elastic License 2.0
Base64 Decoded Payload Piped to Interpreter	High	Elastic detection rules	Oct 3, 2026	Elastic License 2.0
ESXi Shell Command Obfuscation	High	Elastic detection rules	Oct 2, 2026	Elastic License 2.0
GenAI Process Performing Encoding/Chunking Prior to Network Activity	Medium	Elastic detection rules	Oct 2, 2026	Elastic License 2.0
GenAI Process Compiling or Generating Executables	Medium	Elastic detection rules	Oct 2, 2026	Elastic License 2.0
PowerShell Encoded Command Execution (Living off the Land)	Medium	Microsoft Sentinel analytics	Sep 30, 2026	MIT License
Suspicious PowerShell from npm Package Install	High	Elastic detection rules	Sep 29, 2026	Elastic License 2.0
Potential PowerShell Obfuscation Using Alias Cmdlets	Low	SigmaHQ	Sep 25, 2026	Detection Rule License 1.1
Suspicious HTML File Creation	Medium	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
Suspicious Windows Powershell Arguments	Medium	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
Suspicious Windows Command Shell Arguments	High	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
Suspicious JavaScript Execution via Deno	High	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
Suspicious Portable Executable Encoded in Powershell Script	Medium	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
Suspicious Execution with NodeJS	High	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
Potential PowerShell Obfuscation via Special Character Overuse	Medium	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
Potential PowerShell Obfuscation via String Reordering	Medium	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
Potential PowerShell Obfuscation via String Concatenation	High	Elastic detection rules	Sep 20, 2026	Elastic License 2.0

Showing 25 of 177

Filter in the catalogue

External references

mitre-attackT1027Open reference

Volexity PowerDuke November 2016Open reference

FireEye Obfuscation June 2017Open reference

FireEye Revoke-Obfuscation July 2017Open reference

Linux/Cdorked.A We Live Security AnalysisOpen reference

Carbon Black Obfuscation Sept 2016Open reference

PaloAlto EncodedCommand March 2017Open reference

Platforms

ESXiLinuxmacOSNetwork DevicesWindows

Kill chain phases

stealth

Relationships

Incoming and outgoing edges in the selected ATT&CK release.

Incoming and outgoing edges in the selected ATT&CK release
Direction	Type	Related object