Cristóbal Martínez Martín; Matthew Demaske, Adaptforward; Red Canary
Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
One such example is the use of certutil to decode a remote access tool portable executable file that has been hidden inside a certificate file.[1] Another example is using the Windows copy /b or type command to reassemble binary fragments into a malicious payload.[2][3]
Sometimes a user's action may be required to open it for deobfuscation or decryption as part of User Execution. The user may also be required to input a password to open a password protected compressed/encrypted file that was provided by the adversary.[4]
Threat groups96th percentile · 96% of ATT&CK techniques have fewer threat groups attributed.
14
CampaignsTop 2%
Campaigns98th percentile · 98% of ATT&CK techniques have fewer campaigns recorded.
301
Tools & malwareTop 1%
Tools & malware99th percentile · 99% of ATT&CK techniques have fewer tools implementing them.
20
Detection rulesTop 14%
Detection rules86th percentile · 85% of ATT&CK techniques have fewer detection rules written.
Deobfuscate/Decode Files or Information MITRE reference T1140
Top 4%of all ATT&CK techniques for number of groups
38 groups have been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.
All 14 campaigns for this technique · 6 newest in this preview
301 software entries are documented implementing this technique. MITRE files each as a tool or as malware; newest first, then by how many groups carry them.
Deobfuscate/Decode Files or Information detection strategy DET0275
MITRE names one behaviour worth catching for this technique and breaks it into 3 analytics, one per platform. Each carries the log sources it needs and the fields you tune per environment.
Detect Adversary Deobfuscation or Decoding of Files and Payloads
Enterprise
3 platforms
AN0767 · Windows
An adversary leverages built-in tools such as certutil.exe, powershell.exe, or copy.exe to decode, reassemble, or extract hidden malicious content from obfuscated containers or encoded formats. The decoding utility often spawns shortly after file staging or download and may be chained with script interpreters or further payload execution.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
Field
What you tune
ToolName
May vary across environments (e.g., certutil, powershell, copy, expand, 7zip)
FileExtensionFilter
Targets may use .txt, .cer, .enc, .b64, .zip, etc. to disguise payloads
CommandLineRegex
Command syntax varies between base64 decoding, copy /b, and expand switches
TimeWindow
Deobfuscation typically follows staging/download within a short timeframe
AN0768 · Linux
The adversary uses native utilities like base64, gzip, tar, or openssl to decode, decompress, or decrypt files that were previously staged or downloaded. These tools may be chained with curl/wget and executed via bash/zsh, often to extract an embedded payload or reverse shell script.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
bash/zsh of base64, tar, gzip, or openssl immediately after file write
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
Field
What you tune
ShellProcessName
Shell interpreter may vary (bash, zsh, dash, sh)
DecodeUtility
May include base64, openssl, gunzip, tar, uudecode
ParentProcess
Expected parent process may vary in attacker chain (e.g., curl, bash, ssh)
ArgumentPattern
Detection regex should support flexible patterning of decode switches
AN0769 · macOS
The adversary invokes built-in scripting or decoding tools like base64, plutil, or AppleScript-based utilities to decode files embedded in staging artifacts. Decoding often occurs post-download or as part of post-exploitation payload deployment via zsh, python, or osascript.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
Field
What you tune
DecodeInterpreter
Could involve base64, osascript, python, perl, or plutil
ExecutionContext
Deobfuscation may happen within GUI app context or LaunchAgent/Daemon
UserContext
May differ depending on local user, root escalation, or persistence method
1 analytic
CertUtil.exe may be used to encode and decode a file, including PE and script code. Encoding will convert a file to base64 with -----BEGIN CERTIFICATE----- and -----END CERTIFICATE----- tags. Malicious usage will include decoding a encoded file that was downloaded. Once decoded, it will be loaded by a parallel process. Note that there are two additional command switches that may be used - encodehex and decodehex. Similarly, the file will be encoded in HEX and later decoded for further execution. During triage, identify the source of the file being decoded. Review its contents or execution behavior for further analysis.
TypeTTPCoverageModerateSubmitted2021
D3FEND techniques
The defensive countermeasure this analytic implements, in MITRE’s D3FEND ontology.
Pseudocode is the canonical logic; the rest are CAR’s translations into vendor query languages.
Pseudocode implementation of the Splunk search below
processes = search Process:Create
certutil_downloads = filter processes where (
exe =”C:\Windows\System32\certutil.exe” AND command_line = *decode* )
output certutil_downloads
To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the Endpoint datamodel in the Processes node.
| tstats count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=certutil.exe Processes.process=*decode* by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
Unit tests
CAR’s own validation procedures for this analytic.
Replay the detection [dataset](https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1140/atomic_red_team/windows-sysmon.log) using the Splunk attack range with the commands below
Using b64decode shell scripts that have Shebang in them. This is commonly how attackers obfuscate passing and executing a shell script. Seen here by TrendMicro, as well as LinPEAS. Also a there is a great Sigma rule here for it.
Using Linux Base64 Encoded shell scripts that have Shebang in them. This is commonly how attackers obfuscate passing and executing a shell script. Seen here by TrendMicro, as well as LinPEAS. Also a there is a great Sigma rule here for it.
An adversary can obfuscate malicious commands or payloads using XOR and execute them on the victim's machine. This test uses Python to decode and execute commands on the machine.
Uses expand.exe to extract a file from a CAB created locally. This simulates adversarial use of expand on cabinet archives.
Upon success, art-expand-source.txt is extracted next to the CAB.
Inputs
Name
Description
Type
Default Value
cab_path
Path to the CAB to expand (created if missing)
path
%TEMP%\art-expand-test.cab
output_dir
Destination directory
path
%TEMP%\art-expand-out
Attack Commandsrun with command_prompt
mkdir "#{output_dir}" >nul 2>&1
echo hello from atomic red team > "PathToAtomicsFolder\T1140\src\art-expand-source.txt"
makecab "PathToAtomicsFolder\T1140\src\art-expand-source.txt" "#{cab_path}"
pushd "#{output_dir}"
expand "#{cab_path}" -F:* .
popd
Cleanup Commands
del "PathToAtomicsFolder\T1140\src\art-expand-source.txt" >nul 2>&1
del "#{cab_path}" >nul 2>&1
rmdir "#{output_dir}" /s /q >nul 2>&1
The following analytic detects the use of CertUtil.exe with the 'decode' argument, which may indicate an attempt to decode a previously encoded file, potentially containing malicious payloads. (...)
The following analytic detects suspicious Base64 decode operations that may indicate malicious activity, such as data exfiltration or execution of encoded commands. (...)
Detects the use of tail to extract bytes at an offset from an image and then decode the base64 value to create a new file with the decoded content. (...)