CmdID

CmdID / Techniques / T1027

T1027.010 Obfuscated Files or Information: Command Obfuscation

Adversaries may obfuscate content during command execution to impede detection. MITRE ATT&CK

2 programs on CmdID 8 Sigma rules T1027.010 on attack.mitre.org

Part of

MITRE ATT&CK
T1027Obfuscated Files or Information

Programs for it

documented by LOLBAS and GTFOBins, or named by its rules
pythonits Sigma rulesrundll32.exeits Sigma rules

Sigma rules tagged with it

process creation, the highest levels first
highObfuscated PowerShell MSI Install via WindowsInstaller COMMeroujan Antonyan (vx3r) · Windows
highPowerShell Dynamic Module Invocation Via ExportedCommands Array IndexNorbert Jaśniewicz (AlphaSOC), Swachchhanda Shrawan Poudel (Nextron Systems) · Windows
highPython One-Liners with Base64 DecodingHugh Ryan (HueCodes), Swachchhanda Shrawan Poudel (Nextron Systems) · Windows
highPython One-Liners with Base64 Decoding - LinuxHugh Ryan (HueCodes), Swachchhanda Shrawan Poudel (Nextron Systems) · Linux
highSuspicious Explorer Process with Whitespace Padding - ClickFix/FileFixSwachchhanda Shrawan Poudel (Nextron Systems) · Windows
mediumInvocation Of Crypto-Classes From The "Cryptography" PowerShell NamespaceAndreas Braathen (mnemonic.io) · Windows
mediumPotential Obfuscated Ordinal Call Via Rundll32Nasreddine Bencherchali (Nextron Systems), Swachchhanda Shrawan Poudel (Nextron Systems) · Windows
mediumSuspicious Usage of For Loop with Recursive Directory Search in CMDJoseliyo Sanchez, @Joseliyo_Jstnk · Windows