Contagious InterviewG1052 ↗
Has obfuscated JavaScript code using Base64 and variable substitutions.1234
tfMITRE ATT&CK sub-technique
Command Obfuscation T1027.010
sub-technique of T1027 Obfuscated Files or Information
- Tactic
- Stealth
- Platforms
- Linux, macOS, Windows
- Version
- 2.0
- Created
- 14 March 2023
- Last modified
- 12 May 2026
- Contributors
- George Thomas; Tim Peck; TruKno
Adversaries may obfuscate content during command execution to impede detection. Command-line obfuscation is a method of making strings and patterns within commands and scripts more difficult to signature and analyze. This type of obfuscation can be included within commands executed by delivered payloads (e.g., Phishing and Drive-by Compromise) or interactively via Command and Scripting Interpreter.[1][2]
ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact
29
Threat groupsTop 5%
Threat groups95th percentile · 95% of ATT&CK techniques have this many threat groups attributed or fewer.6
CampaignsTop 7%
Campaigns93rd percentile · 93% of ATT&CK techniques have this many campaigns recorded or fewer.35
Tools & malwareTop 11%
Tools & malware89th percentile · 89% of ATT&CK techniques have this many tools implementing them or fewer.12
Detection rulesTop 21%
Detection rules79th percentile · 79% of ATT&CK techniques have this many detection rules written or fewer.Command Obfuscation MITRE reference T1027.010
Top 5%of all ATT&CK techniques for number of groups
29 groups have been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.
Medusa GroupG1051 ↗
Has obfuscated PowerShell scripts with Base64 encoding.1 Medusa Group has also obfuscated the code of dropped kernel drivers using a software known as Safengine Shielden which randomized the code through code mutations and then leveraged an embedded virtual machine interpreter to execute the code.2
PlayG1040 ↗
Has used Base64-encoded PowerShell scripts for post exploit activities on compromised hosts.1
Aquatic PandaG0143 ↗
Has encoded PowerShell commands in Base64.1
LazyScripterG0140 ↗
Has leveraged the BatchEncryption tool to perform advanced batch script obfuscation and encoding techniques.1
TA551G0127 ↗
Has used obfuscated variable names in a JavaScript configuration file.1
All 29 groups for this technique · 6 newest in this preview
6 campaigns have been recorded using this technique. Listed newest first; dates are year-granularity and attribution is MITRE’s.
SharePoint ToolShell ExploitationC0058 ↗
During SharePoint ToolShell Exploitation, threat actors executed Base64-encoded PowerShell commands.12345
C0018C0018 ↗
During C0018, the threat actors used Base64 to encode their PowerShell scripts.12
Operation CuckooBeesC0012 ↗
During Operation CuckooBees, the threat actors executed an encoded VBScript file.1
FrankensteinC0001 ↗
During Frankenstein, the threat actors ran encoded commands from the command line.1
C0021C0021 ↗
During C0021, the threat actors used encoded PowerShell commands.12
Operation WocaoC0014 ↗
During Operation Wocao, threat actors executed PowerShell commands which were encoded or compressed using Base64, zlib, and XOR.1
All 6 campaigns for this technique
35 software entries are documented implementing this technique. MITRE files each as a tool or as malware; newest first, then by how many groups carry them.
Tsundere BotnetS9034 ↗
Tsundere Botnet’s MSI installer has Base64-encoded command execution.1
IronWindS9029 ↗
Has used Base64 encoding and XOR encryption with the key “53” to obfuscate command strings.1
PHASEJAMS9014 ↗
Has encoded commands with Base64.1
XORIndex LoaderS1248 ↗
Has obfuscated strings using ASCII buffers and TextDecoder.1
RedLine StealerS1240 ↗
Has obfuscated scripts within text files used in execution.1
HavocS1229 ↗
Has utilized XOR encryption with the key “01-01-1900” to obfuscate command strings.1
All 35 software entries for this technique · 6 newest in this preview
Offense vs defense T1027.010
Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.
How it got here
Range
Adversary activity (campaign spans) over cumulative rule output. Each source is plotted independently from zero, so neither line includes the other. Campaign dates are year-granularity.
Campaigns · 6Sigma rules (cumulative) · 10Splunk ESCU (cumulative) · 2
first rule: 2021 Q2 · 6 of 6 campaigns plottedCommand Obfuscation detection strategy DET0505
MITRE names one behaviour worth catching for this technique and breaks it into 3 analytics, one per platform. Each carries the log sources it needs and the fields you tune per environment.
Detection Strategy for Command Obfuscation
3 platforms
AN1394 · Windows
Detection of command-line activity exhibiting syntactic obfuscation patterns, such as excessive escape characters, base64 encoding, command concatenation, or outlier command length and entropy.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Process CreationDC0032 | WinEventLog:Security | EventCode=4688 |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| CommandLineEntropyThreshold | Used to flag base64 or token-heavy command-line strings |
| SuspiciousCharacterCount | Escape character and symbol frequency in command-line strings |
| TimeWindow | Window between command execution and follow-up child or file write behavior |
AN1395 · Linux
Detection of shell commands that leverage encoded execution, command chaining, excessive piping, or unusual token patterns indicative of obfuscation.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Process CreationDC0032 | auditd:SYSCALL | execve |
| Command ExecutionDC0064 | linux:osquery | process_events.command_line |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| CommandLineTokenCount | Tuning value for token or argument count in shell invocations |
| EncodedExecRegex | Environment-specific regex patterns for encoded or eval'd command lines |
| GlobPatternAnomalies | Shell-specific globbing or directory traversal string detection |
AN1396 · macOS
Detection of obfuscated commands via shell, osascript, or AppleScript interpreters using unusual tokens, encoding, variable substitution, or runtime string reconstruction.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Process CreationDC0032 | macos:endpointsecurity | ES_EVENT_TYPE_NOTIFY_EXEC |
| Command ExecutionDC0064 | macos:unifiedlog | process:spawn, process:exec |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| InterpreterParentFilter | Limits detection scope to shell or scripting interpreters like zsh, bash, osascript |
| ScriptEntropyThreshold | Minimum entropy required to consider the command or script obfuscated |
| ArgumentLengthDeviation | Deviation from baseline for long or highly nested arguments |
Consider utilizing the Antimalware Scan Interface (AMSI) on Windows 10+ to analyze commands after being processed/interpreted.
On Windows 10+, enable Attack Surface Reduction (ASR) rules to block execution of potentially obfuscated scripts.