CmdID / Techniques / T1027

T1027.009 Obfuscated Files or Information: Embedded Payloads

Adversaries may embed payloads within other files to conceal malicious content from defenses. MITRE ATT&CK

1 Sigma rule T1027.009 on attack.mitre.org

Part of

MITRE ATT&CK

T1027Obfuscated Files or Information

Sigma rules tagged with it

process creation, the highest levels first

highPowershell Token Obfuscation - Process Creationfrack113 · Windows

Command lines CmdID reads as it

everyday examples from tldr-pages, CC BY 4.0

Get the scriptblock that defines a property for a specified object on the page for Get-TypeData

(Get-TypeData -TypeName System.DateTime).Members["DateTime"].GetScriptBlock
if ((& { Set-StrictMode -Version 1; $this.DisplayHint }) -ieq "Date") {
"{0}" -f $this.ToLongDateString()
}
elseif ((& { Set-StrictMode -Version 1; $this.DisplayHint }) -ieq "Time") {
"{0}" -f $this.ToLongTimeString()
}
else {
"{0} {1}" -f $this.ToLongDateString(), $this.ToLongTimeString()
}

Identify

An example is here when CmdID’s reading of it names T1027.009: a Sigma rule it trips is tagged with it, or its abuse is documented as it.