T1140 Deobfuscate/Decode Files or Information

Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. MITRE ATT&CK

4 programs on CmdID 15 Sigma rules T1140 on attack.mitre.org

Programs for it

documented by LOLBAS and GTFOBins, or named by its rules

certutil.exeDecode mshta.exeits Sigma rules opensslits Sigma rules wgetits Sigma rules

Sigma rules tagged with it

process creation, the highest levels first

highBase64 Encoded PowerShell Command DetectedFlorian Roth (Nextron Systems) · Windows

highMSHTA Execution with Suspicious File ExtensionsDiego Perez (@darkquassar), Markus Neis, Swisscom (Improve Rule), Swachchhanda Shrawan Poudel (Nextron Systems) · Windows

highPing Hex IPFlorian Roth (Nextron Systems) · Windows

highPotential Base64 Decoded From ImagesJoseliyo Sanchez, @Joseliyo_Jstnk · macOS

highPotential BlackByte Ransomware ActivityFlorian Roth (Nextron Systems) · Windows

highPowerShell Base64 Encoded FromBase64String CmdletFlorian Roth (Nextron Systems) · Windows

highUNC4841 - Download Compressed Files From Temp.sh Using WgetNasreddine Bencherchali (Nextron Systems) · Linux

highUNC4841 - Download Tar File From Untrusted Direct IP Via WgetNasreddine Bencherchali (Nextron Systems) · Linux

highUNC4841 - SSL Certificate Exfiltration Via OpensslNasreddine Bencherchali (Nextron Systems) · Linux

mediumLinux Base64 Encoded Pipe to ShellpH-T (Nextron Systems) · Linux

mediumLinux Base64 Encoded Shebang In CLINasreddine Bencherchali (Nextron Systems) · Linux

mediumLinux Shell Pipe to ShellFlorian Roth (Nextron Systems) · Linux

mediumPayload Decoded and Decrypted via Built-in UtilitiesTim Rauch (rule), Elastic (idea) · macOS

mediumPotential Commandline Obfuscation Using Escape Charactersjuju4 · Windows

mediumSuspicious XOR Encoded PowerShell CommandSami Ruohonen, Harish Segar, Tim Shelton, Teymur Kheirkhabarov, Vasiliy Burov, oscd.community, Nasreddine Bencherchali · Windows