tfMITRE ATT&CK sub-technique

Encrypted/Encoded File T1027.013

sub-technique of T1027 Obfuscated Files or Information

Tactic: Stealth
Platforms: Linux, macOS, Windows
Version: 2.0
Created: 29 March 2024
Last modified: 12 May 2026
Contributors: Andrew Northern, @ex_raritas; David Galazin @themalwareman1; Jai Minton, @Cyberraiju

Adversaries may encrypt or encode files to obfuscate strings, bytes, and other specific patterns to impede detection. Encrypting and/or encoding file content aims to conceal malicious artifacts within a file used in an intrusion. Many other techniques, such as Software Packing, Steganography, and Embedded Payloads, share this same broad objective. Encrypting and/or encoding files could lead to a lapse in detection of static signatures, only for this malicious content to be revealed (i.e., Deobfuscate/Decode Files or Information) at the time of execution/use.

ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact

Threat groupsTop 4%

Threat groups96th percentile · 96% of ATT&CK techniques have this many threat groups attributed or fewer.

CampaignsTop 2%

Campaigns98th percentile · 98% of ATT&CK techniques have this many campaigns recorded or fewer.

195

Tools & malwareTop 2%

Tools & malware98th percentile · 98% of ATT&CK techniques have this many tools implementing them or fewer.

Detection rules42nd pct

Detection rules42nd percentile · 58% of ATT&CK techniques have more detection rules written.

Encrypted/Encoded File MITRE reference T1027.013

Top 4%of all ATT&CK techniques for number of groups

40 groups have been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.

MirrorFaceG1054 ↗

Has used Base64 encoded shellcode in infection chains to evade detection.1

created 2026-04-171 referenceaka Earth Kasha

Contagious InterviewG1052 ↗

Has used hexadecimal string encoding to hide critical JavaScript module names, function names, and C2 URLs, which are decoded dynamically at runtime.1

created 2025-10-191 referenceaka DeceptiveDevelopment

Storm-1811G1046 ↗

XOR encodes a Cobalt Strike installation payload in a DLL file that is decoded with a hardcoded key when called by a legitimate 7zip installation process.1

created 2025-03-141 reference

Moonstone SleetG1036 ↗

Has used encrypted payloads within files for follow-on execution and defense evasion.1

created 2024-08-261 referenceaka Storm-1789

Saint BearG1031 ↗

Initial payloads included encoded follow-on payloads located in the resources file of the first-stage loader.1

created 2024-05-251 referenceaka Storm-0587

MalteiroG1026 ↗

Has used scripts encoded in Base64 certificates to distribute malware to victims.1

created 2024-03-131 reference

All 40 groups for this technique · 6 newest in this preview

13 campaigns have been recorded using this technique. Listed newest first; dates are year-granularity and attribution is MITRE’s.

2025 Poland Wiper AttacksC0063 ↗

During the 2025 Poland Wiper Attacks, the adversaries utilized a Base64-encoded ZIP archive to prevent content analysis.1

2025

RedPenguinC0056 ↗

During RedPenguin, UNC3886 generated Base64-encoded files in the FreeBSD shell environment of targeted Juniper devices.1 2

2024–2025

Cutting EdgeC0029 ↗

During Cutting Edge, threat actors used a Base64-encoded Python script to write a patched version of the Ivanti Connect Secure dsls binary.1

2023–2024

ShadowRayC0045 ↗

During ShadowRay, threat actors used Base64-encrypted Python code to evade detection.1

2023–2024

RedDelta Modified PlugX Infection Chain OperationsC0047 ↗

Mustang Panda stored installation payloads as encrypted files in hidden folders during RedDelta Modified PlugX Infection Chain Operations.1

2023–2024

APT41 DUSTC0040 ↗

Used encrypted payloads decrypted and executed in memory.1

2023–2024

All 13 campaigns for this technique · 6 newest in this preview

Offense vs defense T1027.013

Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.

How it got here

Range

Adversary activity (campaign spans) over cumulative rule output. Each source is plotted independently from zero, so neither line includes the other. Campaign dates are year-granularity.

Campaigns · 11Sigma rules (cumulative) · 0Splunk ESCU (cumulative) · 1

first rule: 2021 Q3 · 11 of 13 campaigns plotted (Operation Dust Storm (dated 2010), Night Dragon (dated 2009) fall before the 2018 window)

Encrypted/Encoded File detection strategy DET0087

MITRE names one behaviour worth catching for this technique and breaks it into 3 analytics, one per platform. Each carries the log sources it needs and the fields you tune per environment.

Encrypted or Encoded File Payload Detection Strategy

Enterprise

3 platforms

AN0237 · Windows

Detection of processes that load or decode encrypted/encoded files in memory and subsequently execute or inject them, indicating payload unpacking or memory-resident malware.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Module LoadDC0016	WinEventLog:Sysmon	EventCode=7
Process CreationDC0032	WinEventLog:Security	EventCode=4688
Process AccessDC0035	WinEventLog:Sysmon	EventCode=10

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
Image	Path of decoder utilities (e.g., certutil.exe, powershell.exe) can vary across environments.
CommandLine	Base64/hex strings used may change per encoded payload.
TimeWindow	The duration between file decode and execution may differ across implementations.

AN0238 · Linux

Detection of suspicious use of shell utilities or scripts that decode or decrypt a payload and execute it without writing to disk.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Process CreationDC0032	auditd:SYSCALL	execve
Network Connection CreationDC0082	linux:Sysmon	EventCode=3, 22

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
UserContext	Normal usage of `base64`, `openssl`, or `gpg` varies by user/role.
ProcessLineage	Parent-child process chains may differ across deployments.
TimeWindow	Time between decode and execution is implementation-specific.

AN0239 · macOS

Detection of encoded payloads being decoded and executed in-memory using scripting tools or third-party decoders.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Process ModificationDC0020	macos:unifiedlog	memory mapping
Process CreationDC0032	macos:endpointsecurity	es_event_exec
Command ExecutionDC0064	macos:unifiedlog	log stream

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
ScriptContent	Encoded payload content varies across adversaries.
ExecutionChain	Sequence of tools or scripts executed can differ.
UserContext	May depend on whether user is admin, daemon, or system account.

Tests3ExecutorsPowerShell 2 · bash 1Need elevation0 of 3Have prerequisites1Have cleanup3Platformswindows, macos, linux

Test

Platform

Executor

Elevation

Prereqs

Cleanup

Ref

Decode Eicar File and Write to File

windows, macos, linux

PowerShell

—

Yes

Decrypt Eicar File and Write to File

windows, macos, linux

PowerShell

—

Yes

Password-Protected ZIP Payload Extraction and Execution

linux, macos

bash

—

Yes

Extracts and executes a script from a password-protected ZIP archive. This technique is commonly used by malware families like Emotet and QBot to deliver payloads via email attachments where the password is provided in the message body. The encrypted ZIP evades static file analysis until extracted at runtime. Upon successful execution, displays confirmation and system information.

Input arguments

Name	Type	Default	Description
zip_password	String	infected	Password used to protect the ZIP archive

Attack command

echo '#!/bin/bash' > /tmp/art_payload.sh
echo 'echo "T1027.013: Payload extracted from encrypted ZIP"' >> /tmp/art_payload.sh
echo 'echo "Hostname: $(hostname)"' >> /tmp/art_payload.sh
echo 'echo "User: $(whoami)"' >> /tmp/art_payload.sh
echo 'uname -a' >> /tmp/art_payload.sh
cd /tmp && zip -P "#{zip_password}" art_encrypted.zip art_payload.sh
rm /tmp/art_payload.sh
echo "Encrypted ZIP created. Extracting with password..."
unzip -P "#{zip_password}" -o /tmp/art_encrypted.zip -d /tmp/
echo "Executing extracted payload:"
bash /tmp/art_payload.sh

Cleanup command

rm -f /tmp/art_payload.sh
rm -f /tmp/art_encrypted.zip

Prerequisite

zip and unzip must be installed

Check

which zip && which unzip

Satisfy

echo "Install zip and unzip using your package manager (apt-get, yum, or brew)"

GUID45bc9e73-4d3f-4e1e-b6db-c636d1885d6a

Tests from Atomic Red Team (MIT licence) · technique definition

Encrypted/Encoded File detections T1027.013

1 rule is mapped to this technique. Parent techniques also include their sub-techniques’ rules. Click a slice or key entry to filter the table.

42nd pctamong all ATT&CK techniques for number of rules

Product

Severity

Library

Drag headers to reorder | Drag edges to resize

Loading detections...

Select	Title	Description	Category	Status	Event	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID	Refs