TA577G1037 ↗
Has used LNK files to execute embedded DLLs.1
tfMITRE ATT&CK sub-technique
Embedded Payloads T1027.009
sub-technique of T1027 Obfuscated Files or Information
- Tactic
- Stealth
- Platforms
- Linux, macOS, Windows
- Version
- 2.0
- Created
- 30 September 2022
- Last modified
- 12 May 2026
- Contributor
- Nick Cairns, @grotezinfosec
Adversaries may embed payloads within other files to conceal malicious content from defenses. Otherwise seemingly benign files (such as scripts and executables) may be abused to carry and obfuscate malicious payloads and content. In some cases, embedded payloads may also enable adversaries to Subvert Trust Controls by not impacting execution controls such as digital signatures and notarization tickets.[1]
ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact
3
Threat groups64th pct
Threat groups64th percentile · 64% of ATT&CK techniques have this many threat groups attributed or fewer.2
CampaignsTop 17%
Campaigns83rd percentile · 83% of ATT&CK techniques have this many campaigns recorded or fewer.19
Tools & malwareTop 18%
Tools & malware82nd percentile · 82% of ATT&CK techniques have this many tools implementing them or fewer.2
Detection rules50th pct
Detection rules50th percentile · 50% of ATT&CK techniques have more detection rules written.Embedded Payloads MITRE reference T1027.009
64th pctamong all ATT&CK techniques for number of groups
3 groups have been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.
Moonstone SleetG1036 ↗
Embedded payloads in trojanized software for follow-on execution.1
Lazarus GroupG0032 ↗
Has distributed malicious payloads embedded in PNG files.1
All 3 groups for this technique
2 campaigns have been recorded using this technique. Listed newest first; dates are year-granularity and attribution is MITRE’s.
3CX Supply Chain AttackC0057 ↗
During the 3CX Supply Chain Attack, AppleJeus uses embedded .dll as apart of a chained delivery mechanism to invoke the COM class factory.1
C0021C0021 ↗
For C0021, the threat actors embedded a base64-encoded payload within a LNK file.1
All 2 campaigns for this technique
19 software entries are documented implementing this technique. MITRE files each as a tool or as malware; newest first, then by how many groups carry them.
CanisterWormS9042 ↗
Has used embedded second stage Base64-encoded payloads.1
DUSTTRAPS1159 ↗
Contains additional embedded DLLs and configuration files that are loaded into memory during execution.1
DUSTPANS1158 ↗
CHIMNEYSWEEPS1149 ↗
Can extract RC4 encrypted embedded payloads for privilege escalation.1
PikabotS1145 ↗
Further decrypts information embedded via steganography using AES-CBC with the same 32 bit key as initial XOR operations combined with the first 16 bytes of the encrypted data as an initialization vector.1 Other Pikabot variants include encrypted, chunked sections of the stage 2 payload in the initial loader .text section before decrypting and assembling these during execution.2
MoneybirdS1137 ↗
Contains a configuration blob embedded in the malware itself.1
All 19 software entries for this technique · 6 newest in this preview
Offense vs defense T1027.009
Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.
How it got here
Range
Adversary activity (campaign spans) over cumulative rule output. Each source is plotted independently from zero, so neither line includes the other. Campaign dates are year-granularity.
Campaigns · 1Sigma rules (cumulative) · 2Splunk ESCU (cumulative) · 0
first rule: 2022 Q4 · 1 of 2 campaigns plotted (C0021 (dated 2018) falls before the 2019 window)Embedded Payloads detection strategy DET0214
MITRE names one behaviour worth catching for this technique and breaks it into 3 analytics, one per platform. Each carries the log sources it needs and the fields you tune per environment.
Detection Strategy for Embedded Payloads
3 platforms
AN0599 · Windows
Detection of executables or scripts containing hidden embedded resources or secondary payloads, often with anomalies in file size vs. functionality or dropped child binaries.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Process CreationDC0032 | WinEventLog:Sysmon | EventCode=1 |
| File CreationDC0039 | WinEventLog:Sysmon | EventCode=11 |
| File MetadataDC0059 | EDR:file | File Metadata Analysis (PE overlays, entropy) |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| OverlaySizeThreshold | Threshold in bytes where appended sections to binaries are considered suspicious |
| ProcessTreeDepth | Controls how far child process lineage is analyzed for dropped embedded payloads |
| TimeWindow | Defines correlation interval between file write and process execution |
AN0600 · Linux
Detection of shell scripts, ELF binaries, or archives containing embedded secondary payloads, self-extracting components, or unusual compression behavior during runtime.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| File AccessDC0055 | ebpf:syscalls | container_file_activity |
| File MetadataDC0059 | linux:osquery | elf_info, hash, yara_matches |
| File ModificationDC0061 | auditd:SYSCALL | open, write |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| FileSectionCount | Tuning value for ELF binaries with appended sections or resources |
| ScriptLength | Threshold for long shell scripts with base64-encoded binary content |
| ExtractedFileCount | Number of files written from a single script execution |
AN0601 · macOS
Detection of Mach-O binaries or AppleScripts that contain nested, encoded, or run-only embedded payloads dropped at runtime.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Process CreationDC0032 | macos:endpointsecurity | ES_EVENT_TYPE_NOTIFY_EXEC |
| File CreationDC0039 | macos:unifiedlog | logd:file write |
| File MetadataDC0059 | macos:osquery | mach_o_info, file_metadata |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| ScriptFormatType | Run-only AppleScripts or signed scripting payloads may require scoped detection |
| DroppedBinaryCount | Threshold on number of binaries created by the parent payload |
| ParentProcessName | Allows focusing on suspicious interpreter or staging tools |
Anti-virus can be used to automatically detect and quarantine suspicious files.
On Windows 10, enable Attack Surface Reduction (ASR) rules to prevent execution of potentially obfuscated scripts.