tfMITRE ATT&CK technique

Deobfuscate/Decode Files or Information T1140

Tactic: Stealth
Platforms: ESXi, Linux, macOS, Windows
Version: 2.0
Created: 14 December 2017
Last modified: 12 May 2026
Contributors: Cristóbal Martínez Martín; Matthew Demaske, Adaptforward; Red Canary

Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.

ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact

Threat groupsTop 4%

Threat groups96th percentile · 96% of ATT&CK techniques have this many threat groups attributed or fewer.

CampaignsTop 2%

Campaigns98th percentile · 98% of ATT&CK techniques have this many campaigns recorded or fewer.

301

Tools & malwareTop 1%

Tools & malware99th percentile · 99% of ATT&CK techniques have this many tools implementing them or fewer.

Detection rulesTop 14%

Detection rules86th percentile · 86% of ATT&CK techniques have this many detection rules written or fewer.

Deobfuscate/Decode Files or Information MITRE reference T1140

Top 4%of all ATT&CK techniques for number of groups

38 groups have been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.

Storm-1811G1046 ↗

Has distributed password-protected archives such as ZIP files during intrusions.1

created 2025-03-141 reference

BlackByteG1043 ↗

Has encoded commands in base64-encoded sections concatenated together in PowerShell.1 BlackByte uses PowerShell commands to disable Windows Defender.2

created 2024-12-162 referencesaka Hecamede

Moonstone SleetG1036 ↗

Delivered payloads using multiple rounds of obfuscation and encoding to evade defenses and analysis.1

created 2024-08-261 referenceaka Storm-1789

Winter VivernG1035 ↗

Delivered exploit payloads via base64-encoded payloads in malicious email messages.1

created 2024-07-291 referenceaka TA473

AgriusG1030 ↗

Has deployed base64-encoded variants of ASPXSpy to evade detection.1

created 2024-05-211 referenceaka Pink Sandstorm

MalteiroG1026 ↗

Has the ability to deobfuscate downloaded files prior to execution.1

created 2024-03-131 reference

All 38 groups for this technique · 6 newest in this preview

Offense vs defense T1140

Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.

How it got here

Range

Adversary activity (campaign spans) over cumulative rule output. Each source is plotted independently from zero, so neither line includes the other. Campaign dates are year-granularity.

Campaigns · 14Sigma rules (cumulative) · 18Splunk ESCU (cumulative) · 2

first rule: 2018 Q1 · 14 of 14 campaigns plotted

Deobfuscate/Decode Files or Information detection strategy DET0275

MITRE names one behaviour worth catching for this technique and breaks it into 3 analytics, one per platform. Each carries the log sources it needs and the fields you tune per environment.

Detect Adversary Deobfuscation or Decoding of Files and Payloads

Enterprise

3 platforms

AN0767 · Windows

An adversary leverages built-in tools such as certutil.exe, powershell.exe, or copy.exe to decode, reassemble, or extract hidden malicious content from obfuscated containers or encoded formats. The decoding utility often spawns shortly after file staging or download and may be chained with script interpreters or further payload execution.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Process CreationDC0032	WinEventLog:Sysmon	EventCode=1
Process AccessDC0035	WinEventLog:Sysmon	EventCode=10
File CreationDC0039	WinEventLog:Sysmon	EventCode=11

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
ToolName	May vary across environments (e.g., certutil, powershell, copy, expand, 7zip)
FileExtensionFilter	Targets may use .txt, .cer, .enc, .b64, .zip, etc. to disguise payloads
CommandLineRegex	Command syntax varies between base64 decoding, copy /b, and expand switches
TimeWindow	Deobfuscation typically follows staging/download within a short timeframe

AN0768 · Linux

The adversary uses native utilities like base64, gzip, tar, or openssl to decode, decompress, or decrypt files that were previously staged or downloaded. These tools may be chained with curl/wget and executed via bash/zsh, often to extract an embedded payload or reverse shell script.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Command ExecutionDC0064	auditd:SYSCALL	bash/zsh of base64, tar, gzip, or openssl immediately after file write

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
ShellProcessName	Shell interpreter may vary (bash, zsh, dash, sh)
DecodeUtility	May include base64, openssl, gunzip, tar, uudecode
ParentProcess	Expected parent process may vary in attacker chain (e.g., curl, bash, ssh)
ArgumentPattern	Detection regex should support flexible patterning of decode switches

AN0769 · macOS

The adversary invokes built-in scripting or decoding tools like base64, plutil, or AppleScript-based utilities to decode files embedded in staging artifacts. Decoding often occurs post-download or as part of post-exploitation payload deployment via zsh, python, or osascript.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Command ExecutionDC0064	macos:unifiedlog	base64 -d or osascript invoked on staged file

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
DecodeInterpreter	Could involve base64, osascript, python, perl, or plutil
ExecutionContext	Deobfuscation may happen within GUI app context or LaunchAgent/Daemon
UserContext	May differ depending on local user, root escalation, or persistence method

1 analytic

CertUtil.exe may be used to encode and decode a file, including PE and script code. Encoding will convert a file to base64 with -----BEGIN CERTIFICATE----- and -----END CERTIFICATE----- tags. Malicious usage will include decoding a encoded file that was downloaded. Once decoded, it will be loaded by a parallel process. Note that there are two additional command switches that may be used - encodehex and decodehex. Similarly, the file will be encoded in HEX and later decoded for further execution. During triage, identify the source of the file being decoded. Review its contents or execution behavior for further analysis.

TypeTTPCoverageModerateSubmitted2021

D3FEND techniques

The defensive countermeasure this analytic implements, in MITRE’s D3FEND ontology.

ID	Name
D3-PSA	Process Spawn Analysis

Data model references

The CAR data model objects, actions and fields the logic reads. Map these to your own schema before implementing.

Object	Action	Field
process	create	exe
process	create	command_line

Implementations

Pseudocode is the canonical logic; the rest are CAR’s translations into vendor query languages.

Pseudocode implementation of the Splunk search below

processes = search Process:Create
certutil_downloads = filter processes where (
  exe =”C:\Windows\System32\certutil.exe” AND command_line = *decode* )
output certutil_downloads

To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the Endpoint datamodel in the Processes node.

| tstats count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=certutil.exe Processes.process=*decode* by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id

Unit tests

CAR’s own validation procedures for this analytic.

Replay the detection [dataset](https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1140/atomic_red_team/windows-sysmon.log) using the Splunk attack range with the commands below

["python attack_range.py replay -dn data_dump [--dump NAME_OF_DUMP]"]

execute the atomic test [T1140](https://github.com/redcanaryco/atomic-red-team/tree/master/atomics/T1140) against a Windows target.

["Invoke-AtomicTest T1140"]

Tests11Executorssh 7 · cmd 3 · bash 1Need elevation0 of 11Have prerequisites6Have cleanup3Platformswindows, linux, macos

Test

Platform

Executor

Elevation

Prereqs

Cleanup

Ref

Deobfuscate/Decode Files Or Information

windows

cmd

—

Yes

Encode/Decode executable Upon execution a file named T1140_calc_decoded.exe will be placed in the temp folder

Input arguments

Name	Type	Default	Description
executable	path	C:\Windows\System32\calc.exe	name of executable

Attack command

certutil -encode #{executable} %temp%\T1140_calc.txt
certutil -decode %temp%\T1140_calc.txt %temp%\T1140_calc_decoded.exe

Cleanup command

del %temp%\T1140_calc.txt >nul 2>&1
del %temp%\T1140_calc_decoded.exe >nul 2>&1

GUIDd7fd8820-7891-427a-8272-4c83af05250f

Certutil Rename and Decode

windows

cmd

—

Yes

Rename certutil and decode a file. This is in reference to latest research by FireEye here

Input arguments

Name	Type	Default	Description
executable	path	C:\Windows\System32\calc.exe	name of executable/file to decode

Attack command

copy %windir%\system32\certutil.exe %temp%\tcm.tmp
%temp%\tcm.tmp -encode #{executable} %temp%\T1140_calc2.txt
%temp%\tcm.tmp -decode %temp%\T1140_calc2.txt %temp%\T1140_calc2_decoded.exe

Cleanup command

del %temp%\tcm.tmp >nul 2>&1
del %temp%\T1140_calc2.txt >nul 2>&1
del %temp%\T1140_calc2_decoded.exe >nul 2>&1

GUID6725053d-97f7-4fb1-9053-d906cb075447

Base64 decoding with Python

linux, macos

—

Use Python to decode a base64-encoded text string and echo it to the console

Input arguments

Name	Type	Default	Description
message	string	Hello from Atomic Red Team test T1140!	Message to print to the screen
encoded_file	path	/tmp/T1140.encoded	File to temporarily save encoded text

Attack command

ENCODED=$(python3 -c 'import base64;enc=base64.b64encode("#{message}".encode());print(enc.decode())')
python3 -c "import base64;dec=base64.b64decode(\"$ENCODED\");print(dec.decode())"
python3 -c "import base64 as d;dec=d.b64decode(\"$ENCODED\");print(dec.decode())"
python3 -c "from base64 import b64decode;dec=b64decode(\"$ENCODED\");print(dec.decode())"
python3 -c "from base64 import b64decode as d;dec=d(\"$ENCODED\");print(dec.decode())"
echo $ENCODED | python3 -c "import base64,sys;dec=base64.b64decode(sys.stdin.read());print(dec.decode())"
echo $ENCODED > #{encoded_file} && python3 -c "import base64;dec=base64.b64decode(open('#{encoded_file}').read());print(dec.decode())"

Prerequisite

Python must be present

Check

which python3

Satisfy

echo "Please install Python 3"

GUID0b249732-0e0a-4897-9e4d-a5751928d948

Base64 decoding with Perl

linux, macos

—

Use Perl to decode a base64-encoded text string and echo it to the console

Input arguments

Name	Type	Default	Description
message	string	Hello from Atomic Red Team test T1140!	Message to print to the screen
encoded_file	path	/tmp/T1140.encoded	File to temporarily save encoded text

Attack command

ENCODED=$(perl -e "use MIME::Base64;print(encode_base64('#{message}'));")
perl -le "use MIME::Base64;print(decode_base64('$ENCODED'));"
echo $ENCODED | perl -le 'use MIME::Base64;print(decode_base64(<STDIN>));'
echo $ENCODED > #{encoded_file} && perl -le 'use MIME::Base64;open($f,"<","#{encoded_file}");print(decode_base64(<$f>));'

Prerequisite

Perl must be present

Check

which perl

Satisfy

echo "Please install Perl"

GUIDf6758f50-5fc4-4f63-a612-04bf16d06b5f

Base64 decoding with shell utilities

linux, macos

—

Use common shell utilities to decode a base64-encoded text string and echo it to the console

Input arguments

Name	Type	Default	Description
message	string	Hello from Atomic Red Team test T1140!	Message to print to the screen
encoded_file	path	/tmp/T1140.encoded	File to temporarily save encoded text

Attack command

ENCODED=$(echo '#{message}' | base64)
printf $ENCODED | base64 -d
echo $ENCODED | base64 -d
echo $(echo $ENCODED) | base64 -d
echo $ENCODED > #{encoded_file} && base64 -d #{encoded_file}
echo $ENCODED > #{encoded_file} && base64 -d < #{encoded_file}
echo $ENCODED > #{encoded_file} && cat #{encoded_file} | base64 -d
echo $ENCODED > #{encoded_file} && cat < #{encoded_file} | base64 -d
bash -c "{echo,\"$(echo $ENCODED)\"}|{base64,-d}"

GUIDa20e6ca6-8bff-47c0-a728-b1168b20896f

Base64 decoding with shell utilities (freebsd)

linux

—

Use common shell utilities to decode a base64-encoded text string and echo it to the console

Input arguments

Name	Type	Default	Description
message	string	Hello from Atomic Red Team test T1140!	Message to print to the screen
encoded_file	path	/tmp/T1140.encoded	File to temporarily save encoded text

Attack command

ENCODED=$(echo '#{message}' | b64encode -r -)
printf $ENCODED | b64decode -r
echo $ENCODED | b64decode -r
echo $(echo $ENCODED) | b64decode -r
echo $ENCODED > #{encoded_file} && b64encode -r #{encoded_file}
echo $ENCODED > #{encoded_file} && b64decode -r < #{encoded_file}
echo $ENCODED > #{encoded_file} && cat #{encoded_file} | b64decode -r
echo $ENCODED > #{encoded_file} && cat < #{encoded_file} | b64decode -r

GUID81a9ba43-142e-49c1-8449-f2186a7f4c05

FreeBSD b64encode Shebang in CLI

linux

—

Using b64decode shell scripts that have Shebang in them. This is commonly how attackers obfuscate passing and executing a shell script. Seen here by TrendMicro, as well as LinPEAS. Also a there is a great Sigma rule here for it.

Input arguments

Name	Type	Default	Description
sh_encoded	string	IyEvYmluL3NoCmVjaG8gImh0dHBzOi8vd3d3LnlvdXR1YmUuY29tL0BhdG9taWNzb25hZnJpZGF5IEZUVyIK	Encoded
bash_encoded	string	IyEvYmluL2Jhc2gKZWNobyAiaHR0cHM6Ly93d3cueW91dHViZS5jb20vQGF0b21pY3NvbmFmcmlkYXkgRlRXIgo=	Encoded
dash_encoded	string	IyEvYmluL2Rhc2gKZWNobyAiaHR0cHM6Ly93d3cueW91dHViZS5jb20vQGF0b21pY3NvbmFmcmlkYXkgRlRXIgo=	Encoded
fish_encoded	string	IyEvYmluL2Rhc2gKZWNobyAiaHR0cHM6Ly93d3cueW91dHViZS5jb20vQGF0b21pY3NvbmFmcmlkYXkgRlRXIgo=	Encoded

Attack command

echo #{bash_encoded} | b64decode -r | sh
echo #{dash_encoded} | b64decode -r | sh
echo #{fish_encoded} | b64decode -r | sh
echo #{sh_encoded} | b64decode -r | sh

Prerequisite

b64decode must be present

Check

which b64decode

Satisfy

echo "please install b64decode"

GUIDd49e99a9-2aae-4c02-9820-6be295552c53

Hex decoding with shell utilities

linux, macos

—

Use common shell utilities to decode a hex-encoded text string and echo it to the console

Input arguments

Name	Type	Default	Description
message	string	Hello from Atomic Red Team test T1140!	Message to print to the screen
encoded_file	path	/tmp/T1140.encoded	File to temporarily save encoded text

Attack command

ENCODED=$(echo '#{message}' | xxd -ps -c 256)
printf $ENCODED | xxd -r -p
echo $ENCODED | xxd -r -p
echo $(echo $ENCODED) | xxd -r -p
echo $ENCODED > #{encoded_file} && xxd -r -p #{encoded_file}
echo $ENCODED > #{encoded_file} && xxd -r -p < #{encoded_file}
echo $ENCODED > #{encoded_file} && cat #{encoded_file} | xxd -r -p
echo $ENCODED > #{encoded_file} && cat < #{encoded_file} | xxd -r -p

Prerequisite

xxd must be present

Check

which xxd

Satisfy

echo "Please install xxd"

GUID7aaaf002-9d92-40f1-831b-0b64df4cba94

Linux Base64 Encoded Shebang in CLI

linux, macos

—

Using Linux Base64 Encoded shell scripts that have Shebang in them. This is commonly how attackers obfuscate passing and executing a shell script. Seen here by TrendMicro, as well as LinPEAS. Also a there is a great Sigma rule here for it.

Input arguments

Name	Type	Default	Description
sh_encoded	string	IyEvYmluL3NoCmVjaG8gImh0dHBzOi8vd3d3LnlvdXR1YmUuY29tL0BhdG9taWNzb25hZnJpZGF5IEZUVyIK	Encoded
bash_encoded	string	IyEvYmluL2Jhc2gKZWNobyAiaHR0cHM6Ly93d3cueW91dHViZS5jb20vQGF0b21pY3NvbmFmcmlkYXkgRlRXIgo=	Encoded
dash_encoded	string	IyEvYmluL2Rhc2gKZWNobyAiaHR0cHM6Ly93d3cueW91dHViZS5jb20vQGF0b21pY3NvbmFmcmlkYXkgRlRXIgo=	Encoded
fish_encoded	string	IyEvYmluL2Rhc2gKZWNobyAiaHR0cHM6Ly93d3cueW91dHViZS5jb20vQGF0b21pY3NvbmFmcmlkYXkgRlRXIgo=	Encoded

Attack command

echo #{bash_encoded} | base64 -d | bash
echo #{dash_encoded} | base64 -d | bash
echo #{fish_encoded} | base64 -d | bash
echo #{sh_encoded} | base64 -d | bash

Prerequisite

base64 must be present

Check

which base64

Satisfy

echo "please install base64"

GUID00604b8a-7ce4-4f1b-9ec6-b82fc9edfed0

XOR decoding and command execution using Python

linux, macos

bash

—

An adversary can obfuscate malicious commands or payloads using XOR and execute them on the victim's machine. This test uses Python to decode and execute commands on the machine.

Input arguments

Name	Type	Default	Description
xor_key	string	waEHleblxiQjoxFJQaIMLdHKz	Key used to decrypt the command
encrypted_command	string	AAkqKQEM	Encrypted command that will be executed

Attack command

python3 -c 'import base64; import subprocess; xor_decrypt = lambda text, key: "".join([chr(c ^ ord(k)) for c, k in zip(base64.b64decode(text.encode()), key)]); command = "#{encrypted_command}"; key = "#{xor_key}"; exec = xor_decrypt(command, key); subprocess.call(exec, shell=True)'

Prerequisite

Python3 must be installed

Check

which python3

Satisfy

echo "Install Python3"

GUID2567f26b-bc11-45e7-a9db-097d28a8f53e

Expand CAB with expand.exe

windows

cmd

—

Yes

Uses expand.exe to extract a file from a CAB created locally. This simulates adversarial use of expand on cabinet archives. Upon success, art-expand-source.txt is extracted next to the CAB.

Input arguments

Name	Type	Default	Description
cab_path	path	%TEMP%\art-expand-test.cab	Path to the CAB to expand (created if missing)
output_dir	path	%TEMP%\art-expand-out	Destination directory

Attack command

mkdir "#{output_dir}" >nul 2>&1
echo hello from atomic red team > "PathToAtomicsFolder\T1140\src\art-expand-source.txt"
makecab "PathToAtomicsFolder\T1140\src\art-expand-source.txt" "#{cab_path}"
pushd "#{output_dir}"
expand "#{cab_path}" -F:* .
popd

Cleanup command

del "PathToAtomicsFolder\T1140\src\art-expand-source.txt" >nul 2>&1
del "#{cab_path}" >nul 2>&1
rmdir "#{output_dir}" /s /q >nul 2>&1

GUIDca02f13c-a616-44d1-b3f7-ecf42e89a449

Tests from Atomic Red Team (MIT licence) · technique definition

Deobfuscate/Decode Files or Information detections T1140

20 rules are mapped to this technique. Parent techniques also include their sub-techniques’ rules. Click a slice or key entry to filter the table.

Top 14%of all ATT&CK techniques for number of rules

Product

Severity

Library

Drag headers to reorder | Drag edges to resize

Loading detections...

Select	Title	Description	Category	Status	Event	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID	Refs