Obfuscated Files or Information T1027

Events covered

24 catalog events are tagged with this technique by at least one rule.

Authoring guide

Patterns shared across the 200 rules above: which fields they filter on, what specific values they look for, and what they exclude. The catalog normalizes field names across vendors so Sigma's Image, Elastic's process.name, and Splunk's process_name collapse into one row. Each rule contributes at most once per row.

Fields filtered most (62 distinct)

The fields most rules look at when detecting this technique. The How column shows the operators authors use (eq, wildcard, regex_match, match) and how often each appears. Sample values are concrete examples to start from, not an exhaustive list.

Top indicator values (1177 distinct)

Specific (field, operator, value) combinations the rules check for, ranked by how many rules under this technique use each one. The Corpus reach column counts how many rules across the entire catalog (any technique) check the same combination. High numbers point to widely-used indicators that are likely noisy on their own; combine them with another condition for useful signal. Blank means the combination is specific to rules under this technique. Click a value to expand the rules under this technique that use it.

Exclusions (150 distinct)

Field/operator/value combinations excluded by rules under this technique (top-level not() clauses), sorted by how many rules exclude each. These are the false-positive paths the community has learned to filter out. A new rule that ignores the high-count entries here will likely fire on the same noisy paths. Click a value to expand the rules under this technique that exclude it.

Rules under this technique

Every rule in the catalog tagged with this technique, grouped by vendor. Click a rule title for its full predicates, exclusions, and indicators.

Sigma 118 rules

• Base64 Encoded PowerShell Command Detected
• Certificate Exported Via Certutil.EXE
• ConvertTo-SecureString Cmdlet Usage Via CommandLine
• Csc.EXE Execution Form Potentially Suspicious Parent
• Dynamic .NET Compilation Via Csc.EXE
• Dynamic .NET Compilation Via Csc.EXE - Hunting
• Dynamic CSharp Compile Artefact
• Encoded PowerShell payload deployed (PowerShell)
• Encoded PowerShell payload deployed via process execution
• Encoded PowerShell payload deployed via service
• Failed Code Integrity Checks
• File Decoded From Base64/Hex Via Certutil.EXE
• File Encoded To Base64 Via Certutil.EXE
• File In Suspicious Location Encoded To Base64 Via Certutil.EXE
• Findstr Launching .lnk File
• HackTool - CrackMapExec PowerShell Obfuscation
• Invocation Of Crypto-Classes From The "Cryptography" PowerShell Namespace
• Invoke-Obfuscation CLIP+ Launcher
• Invoke-Obfuscation CLIP+ Launcher - PowerShell
• Invoke-Obfuscation CLIP+ Launcher - PowerShell Module
• Invoke-Obfuscation CLIP+ Launcher - Security
• Invoke-Obfuscation CLIP+ Launcher - System
• Invoke-Obfuscation COMPRESS OBFUSCATION
• Invoke-Obfuscation COMPRESS OBFUSCATION - PowerShell
• Invoke-Obfuscation COMPRESS OBFUSCATION - PowerShell Module
• Invoke-Obfuscation COMPRESS OBFUSCATION - Security
• Invoke-Obfuscation COMPRESS OBFUSCATION - System
• Invoke-Obfuscation Obfuscated IEX Invocation
• Invoke-Obfuscation Obfuscated IEX Invocation - PowerShell
• Invoke-Obfuscation Obfuscated IEX Invocation - PowerShell Module
• Invoke-Obfuscation Obfuscated IEX Invocation - Security
• Invoke-Obfuscation Obfuscated IEX Invocation - System
• Invoke-Obfuscation RUNDLL LAUNCHER - PowerShell
• Invoke-Obfuscation RUNDLL LAUNCHER - PowerShell Module
• Invoke-Obfuscation RUNDLL LAUNCHER - Security
• Invoke-Obfuscation RUNDLL LAUNCHER - System
• Invoke-Obfuscation STDIN+ Launcher
• Invoke-Obfuscation STDIN+ Launcher - Powershell
• Invoke-Obfuscation STDIN+ Launcher - PowerShell Module
• Invoke-Obfuscation STDIN+ Launcher - Security
• Invoke-Obfuscation STDIN+ Launcher - System
• Invoke-Obfuscation VAR+ Launcher
• Invoke-Obfuscation VAR+ Launcher - PowerShell
• Invoke-Obfuscation VAR+ Launcher - PowerShell Module
• Invoke-Obfuscation VAR+ Launcher - Security
• Invoke-Obfuscation VAR+ Launcher - System
• Invoke-Obfuscation VAR++ LAUNCHER OBFUSCATION
• Invoke-Obfuscation VAR++ LAUNCHER OBFUSCATION - PowerShell
• Invoke-Obfuscation VAR++ LAUNCHER OBFUSCATION - PowerShell Module
• Invoke-Obfuscation VAR++ LAUNCHER OBFUSCATION - Security
• Invoke-Obfuscation VAR++ LAUNCHER OBFUSCATION - System
• Invoke-Obfuscation Via Stdin
• Invoke-Obfuscation Via Stdin - Powershell
• Invoke-Obfuscation Via Stdin - PowerShell Module
• Invoke-Obfuscation Via Stdin - Security
• Invoke-Obfuscation Via Stdin - System
• Invoke-Obfuscation Via Use Clip
• Invoke-Obfuscation Via Use Clip - Powershell
• Invoke-Obfuscation Via Use Clip - PowerShell Module
• Invoke-Obfuscation Via Use Clip - Security
• Invoke-Obfuscation Via Use Clip - System
• Invoke-Obfuscation Via Use MSHTA
• Invoke-Obfuscation Via Use MSHTA - PowerShell
• Invoke-Obfuscation Via Use MSHTA - PowerShell Module
• Invoke-Obfuscation Via Use MSHTA - Security
• Invoke-Obfuscation Via Use MSHTA - System
• Invoke-Obfuscation Via Use Rundll32 - PowerShell
• Invoke-Obfuscation Via Use Rundll32 - PowerShell Module
• Invoke-Obfuscation Via Use Rundll32 - Security
• Invoke-Obfuscation Via Use Rundll32 - System
• Obfuscated payload transfered via service name - Tchopper (command)
• Obfuscated PowerShell MSI Install via WindowsInstaller COM
• Operation Wocao Activity
• Operation Wocao Activity - Security
• Password Protected ZIP File Opened
• Password Protected ZIP File Opened (Email Attachment)
• Password Protected ZIP File Opened (Suspicious Filenames)
• Ping Hex IP
• Potential Application Whitelisting Bypass via Dnx.EXE
• Potential CommandLine Obfuscation Using Unicode Characters
• Potential CommandLine Obfuscation Using Unicode Characters From Suspicious Image
• Potential Emotet Activity
• Potential Encoded PowerShell Patterns In CommandLine
• Potential Obfuscated Ordinal Call Via Rundll32
• Potential PowerShell Command Line Obfuscation
• Potential PowerShell Obfuscation Using Alias Cmdlets
• Potential PowerShell Obfuscation Using Character Join
• Potential PowerShell Obfuscation Via Reversed Commands
• Potential PowerShell Obfuscation Via WCHAR/CHAR
• Potential Secure Deletion with SDelete
• Potential Suspicious Execution From GUID Like Folder Names
• Potential Winnti Dropper Activity
• Potentially Suspicious Long Filename Pattern - Linux
• PowerShell Base64 Encoded Invoke Keyword
• PowerShell Base64 Encoded Reflective Assembly Load
• PowerShell Base64 Encoded WMI Classes
• Powershell Token Obfuscation - Powershell
• Powershell Token Obfuscation - Process Creation
• PUA - DefenderCheck Execution
• PUA - Potential PE Metadata Tamper Using Rcedit
• Python Image Load By Non-Python Process
• Python One-Liners with Base64 Decoding
• Registry Set With Crypto-Classes From The "Cryptography" PowerShell Namespace
• Renamed AutoIt Execution
• Suspicious Download Via Certutil.EXE
• Suspicious Encoded And Obfuscated Reflection Assembly Load Function Call
• Suspicious Explorer Process with Whitespace Padding - ClickFix/FileFix
• Suspicious File Downloaded From Direct IP Via Certutil.EXE
• Suspicious File Downloaded From File-Sharing Website Via Certutil.EXE
• Suspicious File Encoded To Base64 Via Certutil.EXE
• Suspicious Get-Variable.exe Creation
• Suspicious Space Characters in RunMRU Registry Path - ClickFix
• Suspicious Space Characters in TypedPaths Registry Path - FileFix
• Suspicious SYSTEM User Process Creation
• Suspicious Usage of For Loop with Recursive Directory Search in CMD
• Suspicious XOR Encoded PowerShell Command
• Turla Group Commands May 2020
• Visual Basic Command Line Compiler Usage

Elastic 23 rules

• Binary Content Copy via Cmd.exe
• Command Obfuscation via Unicode Modifier Letters
• Deprecated - Encoded Executable Stored in the Registry
• Dynamic IEX Reconstruction via Method String Access
• File Compressed or Archived into Common Format by Unsigned Process
• Potential Dynamic IEX Reconstruction via Environment Variables
• Potential PowerShell Obfuscation via Backtick-Escaped Variable Expansion
• Potential PowerShell Obfuscation via Character Array Reconstruction
• Potential PowerShell Obfuscation via Concatenated Dynamic Command Invocation
• Potential PowerShell Obfuscation via High Numeric Character Proportion
• Potential PowerShell Obfuscation via High Special Character Proportion
• Potential PowerShell Obfuscation via Invalid Escape Sequences
• Potential PowerShell Obfuscation via Reverse Keywords
• Potential PowerShell Obfuscation via Special Character Overuse
• Potential PowerShell Obfuscation via String Concatenation
• Potential PowerShell Obfuscation via String Reordering
• PowerShell Obfuscation via Negative Index String Reversal
• Suspicious .NET Code Compilation
• Suspicious Execution with NodeJS
• Suspicious HTML File Creation
• Suspicious JavaScript Execution via Deno
• Suspicious Windows Command Shell Arguments
• Suspicious Windows Powershell Arguments

Splunk 48 rules

• Certutil Execution (Sysmon)
• Certutil Execution (Windows Event Log)
• Certutil File Download (PowerShell)
• Certutil File Download (Sysmon)
• Certutil File Download (Windows Event Log)
• Certutil Obfuscate_Encode Files (EDR)
• Certutil Obfuscate_Encode Files (PowerShell)
• Certutil Obfuscate_Encode Files (Sysmon)
• Certutil Obfuscate_Encode Files (Windows Event Log)
• Command Line Homoglyphs - Windows (PowerShell)
• Command Line Homoglyphs - Windows (Sysmon)
• Command Line Homoglyphs - Windows (Windows Event Log)
• Compressed File Execution (Windows Event Log)
• CSC Execution (EDR)
• CSC Execution (Windows Event Log)
• CSC Net On The Fly Compilation
• Curl Execution with Percent Encoded URL
• DLL Concatenation (PowerShell)
• DLL Concatenation (Sysmon)
• DLL Concatenation (Windows Event Log)
• Encoded Powershell Command (PowerShell)
• Encoded Powershell Command (Sysmon)
• Encoded Powershell Command (Windows Event Log)
• Impacket atexec.py Execution (PowerShell)
• Impacket atexec.py Execution (Sysmon)
• Impacket atexec.py Execution (Windows Event Log)
• Impacket atexec.py Scheduled Task Creation (Windows Event Log)
• Impacket atexec.py Temp File Creation (Sysmon)
• Impacket atexec.py Temp File Creation (Windows Event Log)
• Malicious PowerShell Process - Encoded Command
• Obfuscated Powershell Techniques (PowerShell)
• PowerShell CreateDecryptor (PowerShell)
• PowerShell CreateDecryptor (Sysmon)
• PowerShell CreateDecryptor (Windows Event Log)
• Powershell Creating Thread Mutex
• Powershell Enable SMB1Protocol Feature
• Powershell Fileless Script Contains Base64 Encoded Content
• PowerShell WebRequest Using Memory Stream
• Suspicious csc.exe Source File Folder (Sysmon)
• Suspicious csc.exe Source File Folder (Windows Event Log)
• Wermgr Process Create Executable File
• Windows Command Obfuscation with Environment Variable Substrings
• Windows Njrat Fileless Storage via Registry
• Windows Obfuscated Files or Information via RAR SFX
• Windows PowerShell Process Implementing Manual Base64 Decoder
• Windows Registry Payload Injection
• Windows Snake Malware File Modification Crmlog
• Windows TinyCC Shellcode Execution

Kusto 9 rules

• Base64 encoded Windows process command-lines
• Base64 encoded Windows process command-lines (Normalized Process Events)
• Ingress Tool Transfer - Certutil
• NRT Base64 Encoded Windows Process Command-lines
• NRT Process executed from binary hidden in Base64 encoded file
• Powershell Empire Cmdlets Executed in Command Line
• Process Creation with Suspicious CommandLine Arguments
• Process executed from binary hidden in Base64 encoded file
• TEARDROP memory-only dropper

YARA-L 2 rules

• Suspicious Download Via Certutil.EXE
• Suspicious File Downloaded From File-Sharing Website Via Certutil.EXE