T1027 Obfuscated Files or Information

Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. MITRE ATT&CK

2 programs on CmdID 40 Sigma rules T1027 on attack.mitre.org

Its sub-techniques

MITRE ATT&CK

T1027.001Obfuscated Files or Information: Binary Padding

T1027.003Obfuscated Files or Information: Steganography

T1027.004Obfuscated Files or Information: Compile After Delivery

T1027.005Obfuscated Files or Information: Indicator Removal from Tools

T1027.009Obfuscated Files or Information: Embedded Payloads

T1027.010Obfuscated Files or Information: Command Obfuscation

T1027.011Obfuscated Files or Information: Fileless Storage

T1027.013Obfuscated Files or Information: Encrypted/Encoded File

Programs for it

documented by LOLBAS and GTFOBins, or named by its rules

base64its Sigma rules certutil.exeits Sigma rules

Sigma rules tagged with it

process creation, the highest levels first

criticalTurla Group Commands May 2020Florian Roth (Nextron Systems) · Windows

highBase64 Encoded PowerShell Command DetectedFlorian Roth (Nextron Systems) · Windows

highFile Decoded From Base64/Hex Via Certutil.EXEFlorian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community · Windows

highFile In Suspicious Location Encoded To Base64 Via Certutil.EXENasreddine Bencherchali (Nextron Systems) · Windows

highInvoke-Obfuscation CLIP+ LauncherJonathan Cheong, oscd.community · Windows

highInvoke-Obfuscation Obfuscated IEX InvocationDaniel Bohannon (@Mandiant/@FireEye), oscd.community · Windows

highInvoke-Obfuscation STDIN+ LauncherJonathan Cheong, oscd.community · Windows

highInvoke-Obfuscation VAR+ LauncherJonathan Cheong, oscd.community · Windows

highInvoke-Obfuscation VAR++ LAUNCHER OBFUSCATIONTimur Zinniatullin, oscd.community · Windows

highInvoke-Obfuscation Via StdinNikita Nazarov, oscd.community · Windows

highInvoke-Obfuscation Via Use ClipNikita Nazarov, oscd.community · Windows

highInvoke-Obfuscation Via Use MSHTANikita Nazarov, oscd.community · Windows

highOperation Wocao ActivityFlorian Roth (Nextron Systems), frack113 · Windows

highPing Hex IPFlorian Roth (Nextron Systems) · Windows

highPotential CommandLine Obfuscation Using Unicode Characters From Suspicious Imagefrack113, Florian Roth (Nextron Systems), Josh Nickels · Windows

highPotential Emotet ActivityFlorian Roth (Nextron Systems) · Windows

highPotential PowerShell Command Line ObfuscationTeymur Kheirkhabarov (idea), Vasiliy Burov (rule), oscd.community, Tim Shelton (fp) · Windows

highPotential PowerShell Obfuscation Via Reversed CommandsTeymur Kheirkhabarov (idea), Vasiliy Burov (rule), oscd.community, Tim Shelton · Windows

highPotential PowerShell Obfuscation Via WCHAR/CHARFlorian Roth (Nextron Systems) · Windows

highPowerShell Base64 Encoded Invoke KeywordpH-T (Nextron Systems), Harjot Singh, @cyb3rjy0t · Windows

highPowerShell Base64 Encoded Reflective Assembly LoadChristian Burkard (Nextron Systems), pH-T (Nextron Systems) · Windows

highPowerShell Base64 Encoded WMI ClassesChristian Burkard (Nextron Systems), Nasreddine Bencherchali (Nextron Systems) · Windows

highRenamed AutoIt ExecutionFlorian Roth (Nextron Systems) · Windows

highSuspicious Encoded And Obfuscated Reflection Assembly Load Function CallpH-T (Nextron Systems) · Windows

highSuspicious File Downloaded From Direct IP Via Certutil.EXENasreddine Bencherchali (Nextron Systems) · Windows

highSuspicious File Downloaded From File-Sharing Website Via Certutil.EXENasreddine Bencherchali (Nextron Systems) · Windows

highSuspicious File Encoded To Base64 Via Certutil.EXENasreddine Bencherchali (Nextron Systems) · Windows

highSuspicious SYSTEM User Process CreationFlorian Roth (Nextron Systems), David ANDRE (additional keywords) · Windows

mediumCertificate Exported Via Certutil.EXEFlorian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community, Nasreddine Bencherchali (Nextron Systems) · Windows

mediumConvertTo-SecureString Cmdlet Usage Via CommandLineTeymur Kheirkhabarov (idea), Vasiliy Burov (rule), oscd.community, Tim Shelton · Windows

mediumFile Encoded To Base64 Via Certutil.EXEFlorian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community, Nasreddine Bencherchali (Nextron Systems) · Windows

mediumInvoke-Obfuscation COMPRESS OBFUSCATIONTimur Zinniatullin, oscd.community · Windows

mediumPotential CommandLine Obfuscation Using Unicode Charactersfrack113, Florian Roth (Nextron Systems) · Windows

mediumPUA - Potential PE Metadata Tamper Using RceditMicah Babinski · Windows

mediumSuspicious Download Via Certutil.EXEFlorian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community, Nasreddine Bencherchali (Nextron Systems) · Windows

mediumSuspicious XOR Encoded PowerShell CommandSami Ruohonen, Harish Segar, Tim Shelton, Teymur Kheirkhabarov, Vasiliy Burov, oscd.community, Nasreddine Bencherchali · Windows

lowDecode Base64 Encoded TextDaniil Yugoslavskiy, oscd.community · Linux

lowDecode Base64 Encoded Text -MacOsDaniil Yugoslavskiy, oscd.community · macOS

lowPotential Encoded PowerShell Patterns In CommandLineTeymur Kheirkhabarov (idea), Vasiliy Burov (rule), oscd.community, Tim Shelton · Windows

lowPotential Suspicious Execution From GUID Like Folder NamesNasreddine Bencherchali (Nextron Systems) · Windows

Command lines CmdID reads as it

everyday examples from tldr-pages, CC BY 4.0

Decode a file on the page for base64

base64 --decode path/to/fileIdentify

Encode a file in hexadecimal on the page for certutil.exe

certutil -encodehex path\to\input_file path\to\output_fileIdentify

Encode a file to Base64 on the page for certutil.exe

certutil -encode path\to\input_file path\to\output_fileIdentify

Add a computer to a domain using predefined computer credentials on the page for Add-Computer

$newADComputerSplat = @{
Name = "Server02"
AccountPassword = (ConvertTo-SecureString -String 'TempJoinPA$$' -AsPlainText -Force)
}
New-ADComputer @newADComputerSplat

# Then this command is run from Server02 which is not yet domain-joined:

$joinCred = New-Object pscredential -ArgumentList ([pscustomobject]@{
UserName = $null
Password = (ConvertTo-SecureString -String 'TempJoinPA$$' -AsPlainText -Force)[0]
})
$addComputerSplat = @{
DomainName = "Domain03"
Options = 'UnsecuredJoin', 'PasswordPass'
Credential = $joinCred
}
Add-Computer @addComputerSplat

Identify

Convert a secure string to an encrypted string on the page for ConvertTo-SecureString

PS C:> $Secure = Read-Host -AsSecureString
PS C:> $Secure
System.Security.SecureString
PS C:> $Encrypted = ConvertFrom-SecureString -SecureString $Secure
PS C:> $Encrypted
01000000d08c9ddf0115d1118c7a00c04fc297eb010000001a114d45b8dd3f4aa11ad7c0abdae98000000000
02000000000003660000a8000000100000005df63cea84bfb7d70bd6842e7efa79820000000004800000a000
000010000000f10cd0f4a99a8d5814d94e0687d7430b100000008bf11f1960158405b2779613e9352c6d1400
0000e6b7bf46a9d485ff211b9b2a2df3bd6eb67aae41
PS C:> $Secure2 = ConvertTo-SecureString -String $Encrypted
PS C:> $Secure2
System.Security.SecureString

Identify

Create a secure string from an encrypted string in a file on the page for ConvertTo-SecureString

$Secure = Read-Host -AsSecureString
$Encrypted = ConvertFrom-SecureString -SecureString $Secure -Key (1..16)
$Encrypted | Set-Content Encrypted.txt
$Secure2 = Get-Content Encrypted.txt | ConvertTo-SecureString -Key (1..16)

Identify

Convert a plain text string to a secure string on the page for ConvertTo-SecureString

$Secure_String_Pwd = ConvertTo-SecureString "P@ssW0rD!" -AsPlainText -ForceIdentify

Set foreground and background colors on the page for Set-PSReadLineOption

Set-PSReadLineOption -Colors @{ "Comment"="$([char]0x1b)[32;47m" }Identify

Set color values for multiple types on the page for Set-PSReadLineOption

Set-PSReadLineOption -Colors @{
# Use a ConsoleColor enum
"Error" = [ConsoleColor]::DarkRed

# 24 bit color escape sequence
"String" = "$([char]0x1b)[38;5;100m"

# RGB value
"Command" = "#8181f7"
}

Identify

Use ViModeChangeHandler to display Vi mode changes on the page for Set-PSReadLineOption

function OnViModeChange {
if ($args[0] -eq 'Command') {
# Set the cursor to a blinking block.
Write-Host -NoNewline "$([char]0x1b)[1 q"
} else {
# Set the cursor to a blinking line.
Write-Host -NoNewline "$([char]0x1b)[5 q"
}
}
Set-PSReadLineOption -ViModeIndicator Script -ViModeChangeHandler $Function:OnViModeChange

Identify

Add items to a property value on the page for Update-List

class Cards {

[System.Collections.Generic.List[string]]$Cards
[string]$Name

Cards([string]$_name) {
$this.Name = $_name
$this.Cards = [System.Collections.Generic.List[string]]::new()
}

NewDeck() {
$_suits = [char]0x2663,[char]0x2666,[char]0x2665,[char]0x2660
$_values = 'A',2,3,4,5,6,7,8,9,10,'J','Q','K'
$_deck = foreach ($s in $_suits){ foreach ($v in $_values){ "$v$s"} }
$this | Update-List -Property Cards -Add $_deck | Out-Null
}

Show() {
Write-Host
Write-Host $this.Name ": " $this.Cards[0..12]
if ($this.Cards.Count -gt 13) {
Write-Host (' ' * ($this.Name.Length+3)) $this.Cards[13..25]
}
if ($this.Cards.Count -gt 26) {
Write-Host (' ' * ($this.Name.Length+3)) $this.Cards[26..38]
}
if ($this.Cards.Count -gt 39) {
Write-Host (' ' * ($this.Name.Length+3)) $this.Cards[39..51]
}
}

Shuffle() { $this.Cards = Get-Random -InputObject $this.Cards -Count 52 }

Sort() { $this.Cards.Sort() }
}

Identify

An example is here when CmdID’s reading of it names T1027: a Sigma rule it trips is tagged with it, or its abuse is documented as it.