Deobfuscate/Decode Files or Information T1140

Events covered

15 catalog events are tagged with this technique by at least one rule.

Authoring guide

These 102 rules share fields, values, and exclusions.

Fields filtered most (63 distinct)

These fields appear most often in rule filters.

Top indicator values (1144 distinct)

These values appear most often in rule predicates.

Exclusions (428 distinct)

These values appear most often in top-level exclusions.

Rules under this technique

These vendors publish rules tagged with this technique.

Sigma 20 rules

• Base64 Encoded PowerShell Command Detected
• Certutil payload obfuscation (command)
• Certutil payload obfuscation - Tchopper (command)
• DNS-over-HTTPS Enabled by Registry
• Linux Base64 Encoded Pipe to Shell
• Linux Base64 Encoded Shebang In CLI
• Linux Shell Pipe to Shell
• MSHTA Execution with Suspicious File Extensions
• Payload Decoded and Decrypted via Built-in Utilities
• Ping Hex IP
• Potential Base64 Decoded From Images
• Potential BlackByte Ransomware Activity
• Potential Commandline Obfuscation Using Escape Characters
• PowerShell Base64 Encoded FromBase64String Cmdlet
• PowerShell Decompress Commands
• Suspicious Inbox Manipulation Rules
• Suspicious XOR Encoded PowerShell Command
• UNC4841 - Download Compressed Files From Temp.sh Using Wget
• UNC4841 - Download Tar File From Untrusted Direct IP Via Wget
• UNC4841 - SSL Certificate Exfiltration Via Openssl

Elastic 62 rules

• AppleScript Decoded via Base64
• Base16 or Base32 Encoding/Decoding Activity
• Base64 Decoded Payload Piped to Interpreter
• Base64 Encoded String Execution via Osascript
• Base64 or Xxd Decode Argument Evasion
• Base64 Shebang Payload Decoded via Built-in Utility
• Binary Content Copy via Cmd.exe
• Command Line Obfuscation via Whitespace Padding
• Decoded or Decrypted Payload Written to Suspicious Directory
• Decoded Payload Piped to Interpreter
• Decoded Payload Piped to Interpreter Detected via Defend for Containers
• Deprecated - Encoded Executable Stored in the Registry
• Deprecated - Potential PowerShell Obfuscated Script
• Dynamic IEX Reconstruction via Method String Access
• Encoded Payload Detected via Defend for Containers
• Executable File Creation via Base64
• Execution of a File Dropped by OpenSSL
• Execution via OpenClaw Agent
• Initial Access or Execution via Microsoft Office Application
• Kernel Unpacking Activity
• Linux Payload Decoded and Decrypted via Built-in Utility
• Long Base64 Command Execution via Interactive Shell
• Long Base64 Encoded Command via Scripting Interpreter
• Long Base64 Encoded Interpreter Command Line
• Multi-Base64 Decoding Attempt from Suspicious Location
• Multi-Layered Deobfuscation via Unusual Parent
• Network File Unzipped via Unsigned or Untrusted Binary
• Payload Decoded and Decrypted via Built-In Utilities
• Payload Decoded via CertUtil
• Potential Dynamic IEX Reconstruction via Environment Variables
• Potential Hex Payload Execution via Command-Line
• Potential Hex Payload Execution via Common Utility
• Potential PowerShell Obfuscated Script via High Entropy
• Potential PowerShell Obfuscation via Backtick-Escaped Variable Expansion
• Potential PowerShell Obfuscation via Character Array Reconstruction
• Potential PowerShell Obfuscation via Concatenated Dynamic Command Invocation
• Potential PowerShell Obfuscation via High Numeric Character Proportion
• Potential PowerShell Obfuscation via High Special Character Proportion
• Potential PowerShell Obfuscation via Invalid Escape Sequences
• Potential PowerShell Obfuscation via Reverse Keywords
• Potential PowerShell Obfuscation via Special Character Overuse
• Potential PowerShell Obfuscation via String Concatenation
• Potential PowerShell Obfuscation via String Reordering
• PowerShell Obfuscation via Negative Index String Reversal
• PowerShell Script with Encryption/Decryption Capabilities
• PowerShell Suspicious Payload Encoded and Compressed
• ROT Encoded Python Script Execution
• ROT encoded Python Script Execution
• Suspicious .NET Reflection via PowerShell
• Suspicious Base64 String Command-line
• Suspicious CertUtil Commands
• Suspicious Content Extracted or Decompressed via Funzip
• Suspicious DD Execution
• Suspicious Deobfuscation via Shell Script
• Suspicious Echo Execution
• Suspicious Echo or Printf Execution Detected via Defend for Containers
• Suspicious Execution from Foomatic-rip or Cupsd Parent
• Suspicious Interpreter Execution Detected via Defend for Containers
• Suspicious OpenSSL Execution via macOS Application
• Suspicious Windows Powershell Arguments
• Unusual Base64 Encoding/Decoding Activity
• Web Server Potential Command Injection Request

Splunk 6 rules

• Certutil De-Obfuscate_Decode Files (Sysmon)
• Certutil De-Obfuscate_Decode Files (Windows Event Log)
• Certutil Execution (Sysmon)
• Certutil Execution (Windows Event Log)
• CertUtil With Decode Argument
• Linux Auditd Base64 Decode Files

Kusto 13 rules

• A host is potentially running PowerShell to send HTTP(S) requests (ASIM Web Session schema)
• Base64 encoded Windows process command-lines
• Base64 encoded Windows process command-lines (Normalized Process Events)
• CertUtil Used for File Download (Living off the Land)
• Dynatrace - Problem detection
• Dynatrace Application Security - Code-Level runtime vulnerability detection
• Dynatrace Application Security - Non-critical runtime vulnerability detection
• Dynatrace Application Security - Third-Party runtime vulnerability detection
• Ingress Tool Transfer - Certutil
• NRT Base64 Encoded Windows Process Command-lines
• NRT Process executed from binary hidden in Base64 encoded file
• Process executed from binary hidden in Base64 encoded file
• Qakbot Discovery Activies

YARA-L 1 rule

• MITRE ATT&CK T1140 Encoded Powershell Command