Obfuscated Files or Information T1027

Events covered

28 catalog events are tagged with this technique by at least one rule.

Authoring guide

Patterns shared across the 242 rules above: which fields they filter on, what specific values they look for, and what they exclude. The catalog normalizes field names across vendors so Sigma's Image, Elastic's process.name, and Splunk's process_name collapse into one row. Each rule contributes at most once per row.

Fields filtered most (97 distinct)

The fields most rules look at when detecting this technique. The How column shows the operators authors use (eq, wildcard, regex_match, match) and how often each appears. Sample values are concrete examples to start from, not an exhaustive list.

Top indicator values (1597 distinct)

Specific (field, operator, value) combinations the rules check for, ranked by how many rules under this technique use each one. The Corpus reach column counts how many rules across the entire catalog (any technique) check the same combination. High numbers point to widely-used indicators that are likely noisy on their own; combine them with another condition for useful signal. Blank means the combination is specific to rules under this technique. Click a value to expand the rules under this technique that use it.

Exclusions (257 distinct)

Field/operator/value combinations excluded by rules under this technique (top-level not() clauses), sorted by how many rules exclude each. These are the false-positive paths the community has learned to filter out. A new rule that ignores the high-count entries here will likely fire on the same noisy paths. Click a value to expand the rules under this technique that exclude it.

Rules under this technique

Every rule in the catalog tagged with this technique, grouped by vendor. Click a rule title for its full predicates, exclusions, and indicators.

Sigma 128 rules

• Base64 Encoded PowerShell Command Detected
• Binary Padding - Linux
• Binary Padding - MacOS
• Certificate Exported Via Certutil.EXE
• ConvertTo-SecureString Cmdlet Usage Via CommandLine
• Csc.EXE Execution Form Potentially Suspicious Parent
• Decode Base64 Encoded Text
• Decode Base64 Encoded Text -MacOs
• Dynamic .NET Compilation Via Csc.EXE
• Dynamic .NET Compilation Via Csc.EXE - Hunting
• Dynamic CSharp Compile Artefact
• Encoded PowerShell payload deployed (PowerShell)
• Encoded PowerShell payload deployed via process execution
• Encoded PowerShell payload deployed via service
• Failed Code Integrity Checks
• File Decoded From Base64/Hex Via Certutil.EXE
• File Encoded To Base64 Via Certutil.EXE
• File In Suspicious Location Encoded To Base64 Via Certutil.EXE
• Findstr Launching .lnk File
• HackTool - CrackMapExec PowerShell Obfuscation
• Invocation Of Crypto-Classes From The "Cryptography" PowerShell Namespace
• Invoke-Obfuscation CLIP+ Launcher
• Invoke-Obfuscation CLIP+ Launcher - PowerShell
• Invoke-Obfuscation CLIP+ Launcher - PowerShell Module
• Invoke-Obfuscation CLIP+ Launcher - Security
• Invoke-Obfuscation CLIP+ Launcher - System
• Invoke-Obfuscation COMPRESS OBFUSCATION
• Invoke-Obfuscation COMPRESS OBFUSCATION - PowerShell
• Invoke-Obfuscation COMPRESS OBFUSCATION - PowerShell Module
• Invoke-Obfuscation COMPRESS OBFUSCATION - Security
• Invoke-Obfuscation COMPRESS OBFUSCATION - System
• Invoke-Obfuscation Obfuscated IEX Invocation
• Invoke-Obfuscation Obfuscated IEX Invocation - PowerShell
• Invoke-Obfuscation Obfuscated IEX Invocation - PowerShell Module
• Invoke-Obfuscation Obfuscated IEX Invocation - Security
• Invoke-Obfuscation Obfuscated IEX Invocation - System
• Invoke-Obfuscation RUNDLL LAUNCHER - PowerShell
• Invoke-Obfuscation RUNDLL LAUNCHER - PowerShell Module
• Invoke-Obfuscation RUNDLL LAUNCHER - Security
• Invoke-Obfuscation RUNDLL LAUNCHER - System
• Invoke-Obfuscation STDIN+ Launcher
• Invoke-Obfuscation STDIN+ Launcher - Powershell
• Invoke-Obfuscation STDIN+ Launcher - PowerShell Module
• Invoke-Obfuscation STDIN+ Launcher - Security
• Invoke-Obfuscation STDIN+ Launcher - System
• Invoke-Obfuscation VAR+ Launcher
• Invoke-Obfuscation VAR+ Launcher - PowerShell
• Invoke-Obfuscation VAR+ Launcher - PowerShell Module
• Invoke-Obfuscation VAR+ Launcher - Security
• Invoke-Obfuscation VAR+ Launcher - System
• Invoke-Obfuscation VAR++ LAUNCHER OBFUSCATION
• Invoke-Obfuscation VAR++ LAUNCHER OBFUSCATION - PowerShell
• Invoke-Obfuscation VAR++ LAUNCHER OBFUSCATION - PowerShell Module
• Invoke-Obfuscation VAR++ LAUNCHER OBFUSCATION - Security
• Invoke-Obfuscation VAR++ LAUNCHER OBFUSCATION - System
• Invoke-Obfuscation Via Stdin
• Invoke-Obfuscation Via Stdin - Powershell
• Invoke-Obfuscation Via Stdin - PowerShell Module
• Invoke-Obfuscation Via Stdin - Security
• Invoke-Obfuscation Via Stdin - System
• Invoke-Obfuscation Via Use Clip
• Invoke-Obfuscation Via Use Clip - Powershell
• Invoke-Obfuscation Via Use Clip - PowerShell Module
• Invoke-Obfuscation Via Use Clip - Security
• Invoke-Obfuscation Via Use Clip - System
• Invoke-Obfuscation Via Use MSHTA
• Invoke-Obfuscation Via Use MSHTA - PowerShell
• Invoke-Obfuscation Via Use MSHTA - PowerShell Module
• Invoke-Obfuscation Via Use MSHTA - Security
• Invoke-Obfuscation Via Use MSHTA - System
• Invoke-Obfuscation Via Use Rundll32 - PowerShell
• Invoke-Obfuscation Via Use Rundll32 - PowerShell Module
• Invoke-Obfuscation Via Use Rundll32 - Security
• Invoke-Obfuscation Via Use Rundll32 - System
• Obfuscated payload transfered via service name - Tchopper (command)
• Obfuscated PowerShell MSI Install via WindowsInstaller COM
• Operation Wocao Activity
• Operation Wocao Activity - Security
• Password Protected ZIP File Opened
• Password Protected ZIP File Opened (Email Attachment)
• Password Protected ZIP File Opened (Suspicious Filenames)
• Ping Hex IP
• Potential Application Whitelisting Bypass via Dnx.EXE
• Potential CommandLine Obfuscation Using Unicode Characters
• Potential CommandLine Obfuscation Using Unicode Characters From Suspicious Image
• Potential Emotet Activity
• Potential Encoded PowerShell Patterns In CommandLine
• Potential Obfuscated Ordinal Call Via Rundll32
• Potential PowerShell Command Line Obfuscation
• Potential PowerShell Obfuscation Using Alias Cmdlets
• Potential PowerShell Obfuscation Using Character Join
• Potential PowerShell Obfuscation Via Reversed Commands
• Potential PowerShell Obfuscation Via WCHAR/CHAR
• Potential Secure Deletion with SDelete
• Potential Suspicious Execution From GUID Like Folder Names
• Potential Winnti Dropper Activity
• Potentially Suspicious Long Filename Pattern - Linux
• PowerShell Base64 Encoded Invoke Keyword
• PowerShell Base64 Encoded Reflective Assembly Load
• PowerShell Base64 Encoded WMI Classes
• Powershell Token Obfuscation - Powershell
• Powershell Token Obfuscation - Process Creation
• PUA - DefenderCheck Execution
• PUA - Potential PE Metadata Tamper Using Rcedit
• Python Image Load By Non-Python Process
• Python One-Liners with Base64 Decoding
• Python One-Liners with Base64 Decoding - Linux
• Registry Set With Crypto-Classes From The "Cryptography" PowerShell Namespace
• Renamed AutoIt Execution
• Steganography Extract Files with Steghide
• Steganography Hide Files with Steghide
• Steganography Hide Zip Information in Picture File
• Steganography Unzip Hidden Information From Picture File
• Suspicious Download Via Certutil.EXE
• Suspicious Encoded And Obfuscated Reflection Assembly Load Function Call
• Suspicious Explorer Process with Whitespace Padding - ClickFix/FileFix
• Suspicious File Downloaded From Direct IP Via Certutil.EXE
• Suspicious File Downloaded From File-Sharing Website Via Certutil.EXE
• Suspicious File Encoded To Base64 Via Certutil.EXE
• Suspicious Filename with Embedded Base64 Commands
• Suspicious Get-Variable.exe Creation
• Suspicious Space Characters in RunMRU Registry Path - ClickFix
• Suspicious Space Characters in TypedPaths Registry Path - FileFix
• Suspicious SYSTEM User Process Creation
• Suspicious Usage of For Loop with Recursive Directory Search in CMD
• Suspicious XOR Encoded PowerShell Command
• Turla Group Commands May 2020
• Visual Basic Command Line Compiler Usage

Elastic 47 rules

• Base16 or Base32 Encoding/Decoding Activity
• Base64 Decoded Payload Piped to Interpreter
• Binary Content Copy via Cmd.exe
• Command Line Obfuscation via Whitespace Padding
• Command Obfuscation via Unicode Modifier Letters
• Data Encrypted via OpenSSL Utility
• Decoded Payload Piped to Interpreter Detected via Defend for Containers
• Deprecated - Encoded Executable Stored in the Registry
• Deprecated - Potential PowerShell Obfuscated Script
• Dynamic IEX Reconstruction via Method String Access
• Encoded Payload Detected via Defend for Containers
• File Compressed or Archived into Common Format by Unsigned Process
• GenAI Process Compiling or Generating Executables
• GenAI Process Performing Encoding/Chunking Prior to Network Activity
• High Command Line Entropy Detected for Privileged Commands
• Long Base64 Encoded Command via Scripting Interpreter
• Microsoft Build Engine Started an Unusual Process
• Multi-Base64 Decoding Attempt from Suspicious Location
• Potential Antimalware Scan Interface Bypass via PowerShell
• Potential Dynamic IEX Reconstruction via Environment Variables
• Potential Hex Payload Execution via Command-Line
• Potential Hex Payload Execution via Common Utility
• Potential PowerShell Obfuscated Script via High Entropy
• Potential PowerShell Obfuscation via Backtick-Escaped Variable Expansion
• Potential PowerShell Obfuscation via Character Array Reconstruction
• Potential PowerShell Obfuscation via Concatenated Dynamic Command Invocation
• Potential PowerShell Obfuscation via High Numeric Character Proportion
• Potential PowerShell Obfuscation via High Special Character Proportion
• Potential PowerShell Obfuscation via Invalid Escape Sequences
• Potential PowerShell Obfuscation via Reverse Keywords
• Potential PowerShell Obfuscation via Special Character Overuse
• Potential PowerShell Obfuscation via String Concatenation
• Potential PowerShell Obfuscation via String Reordering
• PowerShell Obfuscation via Negative Index String Reversal
• PowerShell Script with Encryption/Decryption Capabilities
• PowerShell Suspicious Payload Encoded and Compressed
• ROT Encoded Python Script Execution
• Suspicious .NET Code Compilation
• Suspicious Content Extracted or Decompressed via Funzip
• Suspicious Execution with NodeJS
• Suspicious HTML File Creation
• Suspicious JavaScript Execution via Deno
• Suspicious Portable Executable Encoded in Powershell Script
• Suspicious Powershell Script
• Suspicious Windows Command Shell Arguments
• Suspicious Windows Powershell Arguments
• Unusual Base64 Encoding/Decoding Activity

Splunk 53 rules

• Certutil Execution (Sysmon)
• Certutil Execution (Windows Event Log)
• Certutil File Download (PowerShell)
• Certutil File Download (Sysmon)
• Certutil File Download (Windows Event Log)
• Certutil Obfuscate_Encode Files (EDR)
• Certutil Obfuscate_Encode Files (PowerShell)
• Certutil Obfuscate_Encode Files (Sysmon)
• Certutil Obfuscate_Encode Files (Windows Event Log)
• Cisco Secure Firewall - Lumma Stealer Activity
• Cisco Secure Firewall - Repeated Malware Downloads
• Cisco Secure Firewall - Snort Rule Triggered Across Multiple Hosts
• Command Line Homoglyphs - Windows (PowerShell)
• Command Line Homoglyphs - Windows (Sysmon)
• Command Line Homoglyphs - Windows (Windows Event Log)
• Compressed File Execution (Windows Event Log)
• CSC Execution (EDR)
• CSC Execution (Windows Event Log)
• CSC Net On The Fly Compilation
• Curl Execution with Percent Encoded URL
• DLL Concatenation (PowerShell)
• DLL Concatenation (Sysmon)
• DLL Concatenation (Windows Event Log)
• Encoded Powershell Command (PowerShell)
• Encoded Powershell Command (Sysmon)
• Encoded Powershell Command (Windows Event Log)
• Impacket atexec.py Execution (PowerShell)
• Impacket atexec.py Execution (Sysmon)
• Impacket atexec.py Execution (Windows Event Log)
• Impacket atexec.py Scheduled Task Creation (Windows Event Log)
• Impacket atexec.py Temp File Creation (Sysmon)
• Impacket atexec.py Temp File Creation (Windows Event Log)
• Linux Decode Base64 to Shell
• Linux Obfuscated Files or Information Base64 Decode
• Malicious PowerShell Process - Encoded Command
• Obfuscated Powershell Techniques (PowerShell)
• PowerShell CreateDecryptor (PowerShell)
• PowerShell CreateDecryptor (Sysmon)
• PowerShell CreateDecryptor (Windows Event Log)
• Powershell Creating Thread Mutex
• Powershell Enable SMB1Protocol Feature
• Powershell Fileless Script Contains Base64 Encoded Content
• PowerShell WebRequest Using Memory Stream
• Suspicious csc.exe Source File Folder (Sysmon)
• Suspicious csc.exe Source File Folder (Windows Event Log)
• Wermgr Process Create Executable File
• Windows Command Obfuscation with Environment Variable Substrings
• Windows Njrat Fileless Storage via Registry
• Windows Obfuscated Files or Information via RAR SFX
• Windows PowerShell Process Implementing Manual Base64 Decoder
• Windows Registry Payload Injection
• Windows Snake Malware File Modification Crmlog
• Windows TinyCC Shellcode Execution

Kusto 11 rules

• Base64 encoded Windows process command-lines
• Base64 encoded Windows process command-lines (Normalized Process Events)
• Cisco Cloud Security - Windows PowerShell User-Agent Detected
• Ingress Tool Transfer - Certutil
• NRT Base64 Encoded Windows Process Command-lines
• NRT Process executed from binary hidden in Base64 encoded file
• Powershell Empire Cmdlets Executed in Command Line
• Process Creation with Suspicious CommandLine Arguments
• Process executed from binary hidden in Base64 encoded file
• TEARDROP memory-only dropper
• Votiro - File Blocked in Email

YARA-L 2 rules

• Suspicious Download Via Certutil.EXE
• Suspicious File Downloaded From File-Sharing Website Via Certutil.EXE

Panther 1 rule

• GitHub Workflow Downloading Artifacts