T1027

Obfuscated Files or Information

Defense Evasion Last updated:

Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior used across different platforms and the network to evade defenses. Payloads may be compressed, archived, or encrypted to avoid detection. Portions of files may be encoded to hide plaintext strings. Payloads may be split into separate benign-looking files that only reveal malicious functionality when reassembled. Real-world examples include BackdoorDiplomacy using VMProtect, Ryuk using anti-disassembly and code transformation, Lokibot and Amadey using Base64 string obfuscation, and SVCReady/ECCENTRICBANDWAGON using RC4/XOR encryption.

What is T1027 Obfuscated Files or Information?

Obfuscated Files or Information (T1027) maps to the Defense Evasion tactic — the adversary is trying to avoid being detected in MITRE ATT&CK.

This page provides production-ready detection logic for Obfuscated Files or Information, covering the data sources and telemetry it touches: Process: Process Creation, Command: Command Execution, Microsoft Defender for Endpoint. The queries below are rated medium severity at medium confidence, and ship for 7 SIEM platforms — KQL, SPL, Elastic, QRadar, Sumo, YARA-L, LogScale.

MITRE ATT&CK

Tactic
Defense Evasion
Technique
T1027 Obfuscated Files or Information
Canonical reference
https://attack.mitre.org/techniques/T1027/
Microsoft Sentinel / Defender
kusto 
let EncodingTools = dynamic(["certutil", "certutil.exe"]);
let EncodingFlags = dynamic(["-decode", "-decodehex", "-encodehex", "-urlcache", "-urlcache -split -f"]);
let SuspiciousEncodingPatterns = dynamic([
  "[Convert]::FromBase64String",
  "[System.Convert]::FromBase64String",
  "[Convert]::ToBase64String",
  "FromBase64String",
  "ToBase64String",
  "-EncodedCommand",
  "-enc ",
  "-e ",
  "-ec ",
  "certutil.*-decode",
  "certutil.*-encodehex"
]);
let ObfuscationIndicators = dynamic([
  "chr(", "chr (",
  "[char]",
  "\\x",
  "0x",
  "HEX:",
  "bxor",
  "-bxor",
  "XOR"
]);
let CompressionTools = dynamic([
  "compress-archive",
  "expand-archive",
  "io.compression",
  "zipfile",
  "7z.exe",
  "7za.exe",
  "rar.exe"
]);
// Branch 1: Certutil used for encoding/decoding (classic LOLBin obfuscation)
let CertutilObfuscation = DeviceProcessEvents
| where Timestamp > ago(24h)
| where FileName =~ "certutil.exe"
| where ProcessCommandLine has_any ("-decode", "-decodehex", "-encodehex", "-urlcache")
| extend ObfuscationMethod = "certutil_encoding"
| extend RiskScore = 3;
// Branch 2: PowerShell Base64 operations outside common admin patterns
let PowerShellBase64 = DeviceProcessEvents
| where Timestamp > ago(24h)
| where FileName in~ ("powershell.exe", "pwsh.exe")
| where ProcessCommandLine has_any (
    "[Convert]::FromBase64String",
    "[System.Convert]::FromBase64String",
    "FromBase64String",
    "-EncodedCommand",
    "-enc ",
    "bxor",
    "-bxor"
  )
| extend ObfuscationMethod = "powershell_base64_or_xor"
| extend RiskScore = 2;
// Branch 3: Wscript/Cscript executing scripts with obfuscated content indicators
let ScriptObfuscation = DeviceProcessEvents
| where Timestamp > ago(24h)
| where FileName in~ ("wscript.exe", "cscript.exe", "mshta.exe")
| where ProcessCommandLine has_any (
    "chr(",
    "[char]",
    "String.fromCharCode",
    "unescape(",
    "escape(",
    "eval("
  )
| extend ObfuscationMethod = "script_charcode_obfuscation"
| extend RiskScore = 2;
// Branch 4: cmd.exe with excessive ^ or % variable expansion obfuscation
let CmdObfuscation = DeviceProcessEvents
| where Timestamp > ago(24h)
| where FileName =~ "cmd.exe"
| where ProcessCommandLine matches regex @"(\^[a-zA-Z0-9]{1}){4,}"
   or (ProcessCommandLine matches regex @"(%[a-zA-Z_][a-zA-Z0-9_]*:~[0-9,]+%){3,}")
| extend ObfuscationMethod = "cmd_caret_or_var_obfuscation"
| extend RiskScore = 3;
// Union all branches
CertutilObfuscation
| union PowerShellBase64
| union ScriptObfuscation
| union CmdObfuscation
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine,
          InitiatingProcessFileName, InitiatingProcessCommandLine,
          ObfuscationMethod, RiskScore
| sort by Timestamp desc

Detects obfuscated file or information patterns across multiple execution vectors in Microsoft Defender for Endpoint. Covers certutil.exe used for Base64/hex encoding and decoding (LOLBin abuse), PowerShell Base64 operations and XOR encoding, script interpreters using character-code obfuscation (chr(), String.fromCharCode(), unescape()), and cmd.exe with caret-insertion or environment variable substring obfuscation. Returns an ObfuscationMethod tag and RiskScore to help analysts prioritize. As a parent technique covering many sub-techniques, individual detections for T1027.001–T1027.017 provide deeper coverage for specific obfuscation variants.

medium severity medium confidence

Data Sources

Process: Process Creation Command: Command Execution Microsoft Defender for Endpoint

Required Tables

DeviceProcessEvents

False Positives

  • Software developers and build pipelines routinely call certutil -encodehex or PowerShell Base64 operations as part of legitimate encoding/decoding workflows
  • IT automation tools (SCCM, Ansible, Intune) often pass encoded configuration blobs to PowerShell as a safe way to handle special characters in installation scripts
  • Security tools and scanners themselves may decode malware samples as part of analysis pipelines on analyst workstations
  • Backup and archiving software may use certutil or 7-zip with password flags that superficially resemble obfuscation patterns
  • Web developers may use JavaScript unescape() or String.fromCharCode() in test scripts that get executed via cscript.exe during CI/CD

Sigma rule & cross-platform mapping

The detection logic for Obfuscated Files or Information (T1027) above is provided in a vendor-neutral form so you can deploy it on any SIEM. The same logic is shipped here as native KQL (Microsoft Sentinel / Defender), SPL (Splunk), Elastic (Elastic Security (EQL)), QRadar (IBM QRadar (AQL)), Sumo (Sumo Logic CSE), YARA-L (Google Chronicle / SecOps), LogScale (CrowdStrike LogScale (CQL)) queries. In Sigma terms, this detection targets the following logsource: 

logsource:
  category: process_creation
  product: windows

Browse the community-maintained Sigma rules for this technique:

SigmaHQ rules for T1027 Sigma rules on detection.fyi

Platform-specific guides for T1027

Detect in Microsoft Sentinel (KQL) Detect in Splunk (SPL) Detect in Elastic Security (Elastic) Detect in IBM QRadar (QRadar) Detect in Sumo Logic CSE (Sumo) Detect in Google Chronicle (YARA-L) Detect in CrowdStrike LogScale (LogScale)
Last updated: 2026-04-14 Research depth: deep
References (8)

Testing Methodology

Validate this detection against 5 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.

  1. Test 1Certutil Base64 Encode and Decode a Payload

    Expected signal: Sysmon Event ID 1: Two Process Create events for certutil.exe — first with CommandLine containing '-encodehex' and output path, second with '-decode' and output path. Sysmon Event ID 11 (File Create): creation of the encoded and decoded output files in %TEMP%. Security Event ID 4688 if command line auditing is enabled. No network events expected for local file operations.

  2. Test 2PowerShell XOR Encoding of a String

    Expected signal: Sysmon Event ID 1: Process Create for powershell.exe with CommandLine containing 'bxor'. PowerShell ScriptBlock Log Event ID 4104 showing the full XOR encoding/decoding script. No file or network events expected.

  3. Test 3Wscript Executing Character-Code Obfuscated VBScript

    Expected signal: Sysmon Event ID 1: Process Create for wscript.exe with CommandLine referencing the .vbs file. Sysmon Event ID 11: File Create of the .vbs file in %TEMP%. The script prints 'df00tech' to a WScript dialog — no network or registry events.

  4. Test 4Cmd.exe Caret Insertion Obfuscation

    Expected signal: Sysmon Event ID 1: Process Create for cmd.exe with CommandLine containing 'w^h^o^a^m^i' (six carets). Depending on audit configuration, a second Process Create for whoami.exe may appear as a child process. Security Event ID 4688 for cmd.exe and whoami.exe if command line auditing is enabled.

  5. Test 5Double-Layer PowerShell Base64 Encoding

    Expected signal: Sysmon Event ID 1: Process Create for powershell.exe with CommandLine containing 'ToBase64String', 'FromBase64String', and 'Invoke-Expression'. PowerShell ScriptBlock Log Event ID 4104 showing the full encoding script. No file or network events.

Response Playbook

Triage

  1. Identify the full obfuscation chain — what process ran the obfuscated content, what was the parent, and what was the grandparent? A chain of cmd.exe → wscript.exe → powershell.exe with encoded content is a strong indicator vs. a standalone admin script.
  2. Decode the obfuscated content immediately: for Base64 use PowerShell `[System.Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('<value>'))` (UTF-16LE for PowerShell) or `[System.Text.Encoding]::ASCII.GetString([Convert]::FromBase64String('<value>'))` (ASCII for other contexts). For certutil-decoded files, examine the output file extension and entropy.
  3. Check the initiating process — did the obfuscated command originate from a document viewer (Word, Excel, Outlook, Adobe Reader), browser, or script host? These are classic phishing delivery indicators. Scheduled tasks and services spawning obfuscation are persistence indicators.
  4. Examine the user account — is this a standard user, service account, or domain admin? Regular end users rarely execute Base64-encoded commands directly. Service accounts running obfuscated payloads should have a corresponding change ticket.
  5. Look at the decoded content — does it contain download URLs, IP addresses, credential harvesting keywords (password, credential, SAMDatabase), lateral movement commands, or further encoding layers (double/triple encoded payloads indicate sophisticated evasion)?
  6. Review DeviceFileEvents around the same timestamp — did the process write any new files to disk, particularly to %TEMP%, %APPDATA%, ProgramData, or public directories? Dropped files are stage-2 payloads.
  7. Check DeviceNetworkEvents for any outbound connections made by the process — obfuscated commands frequently precede C2 check-ins or data exfiltration.

Containment

  1. If the decoded payload is malicious or if network connections to external IPs are observed: immediately isolate the endpoint using EDR network isolation to prevent C2 communication and lateral movement while preserving forensic state.
  2. If a malicious file was dropped to disk by the decoded payload: quarantine the file via EDR and block its SHA256 hash at the AV/EDR policy level before it can execute on other endpoints.
  3. If the obfuscated command originated from a document or email: block the sender domain and the document hash at email gateway; notify the user and check for additional recipients of the same email.
  4. If the activity appears to use a compromised or misused service account: disable the account in Active Directory immediately, revoke active sessions, and audit all recent actions performed under that account.
  5. Block any URLs or domains identified in decoded payloads at the web proxy and DNS resolver. Submit the IOCs to threat intelligence sharing platforms for broader community defense.
  6. If certutil.exe was used to decode a file: retain the output file as evidence before quarantine, noting the output path from the command line arguments.

Evidence Collection

  1. PowerShell ScriptBlock Logging (Event ID 4104 from Microsoft-Windows-PowerShell/Operational) — captures the full deobfuscated script content after decoding, essential for determining what the encoded command actually did.
  2. PowerShell Module Logging (Event ID 4103) — records pipeline execution and parameter binding for decoded commands.
  3. Sysmon Event ID 1 (Process Create) — full command line including all obfuscation flags, parent process, and process tree ancestry.
  4. Sysmon Event ID 11 (File Create) — any files written to disk as output of decoding/extraction operations, particularly in temp, staging, or unusual directories.
  5. Sysmon Event ID 3 (Network Connection) — outbound connections made by the obfuscated process; correlate timestamps with the process creation event.
  6. certutil.exe output files — if certutil was used with -decode, identify the output file path from the command line arguments and collect the decoded binary for analysis.
  7. Prefetch files — C:\Windows\Prefetch\ entries for certutil.exe, powershell.exe, wscript.exe, etc. provide execution timestamps and loaded DLLs.
  8. Windows Event ID 4688 (Security log, if command line auditing is enabled) — provides process creation events with command line data as a backup to Sysmon.
  9. Browser downloads and email attachments — if the obfuscated file arrived via browser or email, collect the source file, originating URL, and sender information from proxy logs and email gateway.

Escalation Criteria

  • ! Decoded payload contains a download cradle (Net.WebClient, Invoke-WebRequest, BitsTransfer, certutil -urlcache) pointing to an external URL — this indicates a multi-stage attack with additional payload delivery.
  • ! Multi-layer obfuscation detected: the decoded content itself contains another layer of encoding (Base64 within Base64, or XOR-then-Base64) — this level of sophistication strongly suggests advanced threat actor or mature malware.
  • ! Obfuscation originated from a document-executing process (WINWORD.EXE, EXCEL.EXE, OUTLOOK.EXE, AcroRd32.exe) — this is a classic phishing execution chain requiring immediate escalation.
  • ! Outbound network connection to a non-corporate public IP observed within 60 seconds of the obfuscated process execution — timing correlation suggests successful C2 check-in.
  • ! The decoded content references credential-related keywords: LSASS, SAM, NTDS, credential, password, mimikatz, sekurlsa — this indicates credential theft intent.
  • ! Same obfuscation pattern observed on more than 3 endpoints in a short time window — suggests automated propagation via worm behavior, lateral movement, or GPO/SCCM compromise.

Investigation Guide

Forensic Artifacts

  • > File System: %TEMP%, %APPDATA%\Roaming, C:\ProgramData\ — most common drop locations for decoded/decompressed stage-2 payloads.
  • > File System: certutil.exe output file path (specified after -decode flag) — the decoded binary for static analysis.
  • > Registry: HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run, HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run — persistence entries that may reference obfuscated scripts.
  • > Registry: HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\RunMRU — recent Run dialog entries showing manually executed obfuscated commands.
  • > Event Log: Microsoft-Windows-PowerShell/Operational Event ID 4104 — deobfuscated ScriptBlock content essential for post-incident analysis.
  • > Event Log: Microsoft-Windows-Windows Defender/Operational Event ID 1116 — AMSI detection events that may fire on decoded content.
  • > ADS (Alternate Data Streams): check Zone.Identifier stream on any dropped files to determine if they originated from the internet (Zone=3).
  • > Prefetch: C:\Windows\Prefetch\CERTUTIL.EXE-*.pf — execution timestamps and referenced files for certutil LOLBin abuse.
  • > Memory: Process memory dump of the obfuscating/decoding process may contain plaintext version of the payload in heap memory before it is written to disk or executed.

Tuning Guidance

T1027 is a broad parent technique with many sub-techniques — tune each detection branch independently. For certutil abuse: baseline all legitimate certutil use by parent process and command line pattern, then build explicit allowlists for SCCM/Intune deployment tasks. For PowerShell Base64: the highest-fidelity signal is FromBase64String in combination with Invoke-Expression (IEX) or a network connection — add this compound condition to reduce false positives from single-indicator encoding operations. For script host (wscript/cscript) obfuscation: allowlist known-good scripts by their full path and hash rather than by directory alone, as adversaries commonly drop scripts to %TEMP% or ProgramData. For cmd.exe caret obfuscation: the caret density threshold of 6+ is conservative — adjust based on your environment's scripting patterns. Security products like SCCM occasionally generate caret-heavy command lines. Exclude specific service accounts (e.g., SYSTEM-run SCCM tasks) by AccountName and InitiatingProcessFileName pair, never by AccountName alone. For all branches: enable and review PowerShell ScriptBlock Logging (GPO: Administrative Templates > Windows Components > Windows PowerShell > Turn on Script Block Logging) as this provides the deobfuscated content that makes all obfuscation-related investigations dramatically faster.

Hunting Queries

Hunt for certutil.exe encode/decode usage grouped by parent process. Legitimate certutil use is typically spawned by administrative scripts with consistent parent processes. Unusual parents (wscript.exe, mshta.exe, Office applications, or browsers) strongly suggest LOLBin abuse for obfuscated payload delivery.

Hunting — KQL
kql 
DeviceProcessEvents
| where Timestamp > ago(7d)
| where FileName =~ "certutil.exe"
| where ProcessCommandLine has_any ("-decode", "-decodehex", "-encodehex")
| summarize Count=count(), Devices=dcount(DeviceName), Accounts=make_set(AccountName),
            CmdSamples=make_set(ProcessCommandLine, 5),
            Earliest=min(Timestamp), Latest=max(Timestamp)
  by InitiatingProcessFileName
| sort by Count desc
Hunting — SPL
spl 
index=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1
  Image="*\\certutil.exe"
  (CommandLine="*-decode*" OR CommandLine="*-decodehex*" OR CommandLine="*-encodehex*")
| stats count as Count, dc(host) as Devices, values(User) as Accounts,
        values(CommandLine) as CmdSamples,
        earliest(_time) as Earliest, latest(_time) as Latest
  by ParentImage
| sort - Count

Hunt for multi-layer Base64 encoding — where the decoded content itself contains another FromBase64String call. This nested encoding is a strong indicator of sophisticated obfuscation designed to evade signature-based detection, as seen in advanced malware dropper stages.

Hunting — KQL
kql 
DeviceProcessEvents
| where Timestamp > ago(7d)
| where FileName in~ ("powershell.exe", "pwsh.exe", "wscript.exe", "cscript.exe")
| where ProcessCommandLine has "FromBase64String" or ProcessCommandLine has "bxor"
| extend Decoded = extract(@"FromBase64String\('([A-Za-z0-9+/=]{20,})'\)", 1, ProcessCommandLine)
| extend HasNestedBase64 = iff(strlen(Decoded) > 0 and Decoded has "FromBase64String", true, false)
| where HasNestedBase64 == true
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine,
          InitiatingProcessFileName, Decoded
| sort by Timestamp desc
Hunting — SPL
spl 
index=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1
  (Image="*\\powershell.exe" OR Image="*\\pwsh.exe" OR Image="*\\wscript.exe" OR Image="*\\cscript.exe")
  CommandLine="*FromBase64String*"
| rex field=CommandLine "FromBase64String\('(?<b64_value>[A-Za-z0-9+/=]{20,})'"
| where len(b64_value) > 0
| eval decoded_preview=urldecode(b64_value)
| where match(CommandLine, "FromBase64String.*FromBase64String")
| table _time, host, User, Image, CommandLine, b64_value, decoded_preview, ParentImage
| sort - _time

Hunt for cmd.exe with high-density caret insertion (^) or environment variable substring obfuscation. Legitimate cmd.exe scripts rarely use more than one or two carets. Six or more scattered carets, or four or more variable substring expressions (%VAR:~N,M%), indicate deliberate obfuscation of the underlying command to evade string-match signatures.

Hunting — KQL
kql 
DeviceProcessEvents
| where Timestamp > ago(7d)
| where FileName =~ "cmd.exe"
| extend CaretCount = array_length(extract_all(@"\^[a-zA-Z0-9]", ProcessCommandLine))
| extend VarSubCount = array_length(extract_all(@"%[a-zA-Z_][a-zA-Z0-9_]*:~[0-9]+,[0-9]+%", ProcessCommandLine))
| where CaretCount >= 6 or VarSubCount >= 4
| project Timestamp, DeviceName, AccountName, ProcessCommandLine,
          InitiatingProcessFileName, InitiatingProcessCommandLine,
          CaretCount, VarSubCount
| sort by CaretCount desc, VarSubCount desc
Hunting — SPL
spl 
index=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1
  Image="*\\cmd.exe"
| rex max_match=50 field=CommandLine "(?<carets>\^[a-zA-Z0-9])"
| rex max_match=50 field=CommandLine "(?<varsubst>%[a-zA-Z_][a-zA-Z0-9_]*:~[0-9]+,[0-9]+%)"
| eval CaretCount=mvcount(carets), VarSubCount=mvcount(varsubst)
| where CaretCount >= 6 OR VarSubCount >= 4
| table _time, host, User, CommandLine, ParentImage, ParentCommandLine, CaretCount, VarSubCount
| sort - CaretCount

Atomic Red Team Tests

Test 1 Certutil Base64 Encode and Decode a Payload
windows

Uses certutil.exe — a built-in Windows LOLBin — to Base64-encode a benign file, then decode it back to a new location. This is a well-documented technique used by threat actors including APT41 and FIN7 to deliver obfuscated payloads that bypass initial content inspection. The certutil decode step is particularly significant as it can reconstruct binaries from Base64 text files.

Command

powershell 
echo This is a test payload > %TEMP%\df00tech-payload.txt && certutil -encodehex -f %TEMP%\df00tech-payload.txt %TEMP%\df00tech-encoded.txt 0x40000001 && certutil -decode %TEMP%\df00tech-encoded.txt %TEMP%\df00tech-decoded.txt

Cleanup

powershell 
del %TEMP%\df00tech-payload.txt %TEMP%\df00tech-encoded.txt %TEMP%\df00tech-decoded.txt 2>nul

Expected Telemetry

Sysmon Event ID 1: Two Process Create events for certutil.exe — first with CommandLine containing '-encodehex' and output path, second with '-decode' and output path. Sysmon Event ID 11 (File Create): creation of the encoded and decoded output files in %TEMP%. Security Event ID 4688 if command line auditing is enabled. No network events expected for local file operations.

Expected Detection

KQL: CertutilObfuscation branch fires with ObfuscationMethod='certutil_encoding'. SPL: CertutilDecode=1, ObfuscationScore >= 1. Both the -encodehex and -decode executions independently trigger the detection.

Test 2 PowerShell XOR Encoding of a String
windows

Demonstrates PowerShell XOR encoding — a technique used extensively by malware families including PowerStallion (Turla) and CHIMNEYSWEEP to obfuscate C2 communications, configuration data, and payload strings. Uses a single-byte XOR key against a benign string to produce an encoded output, then decodes it. Real malware uses this pattern to hide URLs, registry keys, and shellcode.

Command

powershell 
powershell.exe -NoProfile -Command "$key = 0x41; $plain = 'df00tech-test-payload'; $encoded = ($plain.ToCharArray() | ForEach-Object { [byte][char]$_ -bxor $key }) -join ','; Write-Output ('Encoded: ' + $encoded); $decoded = ($encoded -split ',' | ForEach-Object { [char]([byte]$_ -bxor $key) }) -join ''; Write-Output ('Decoded: ' + $decoded)"

Expected Telemetry

Sysmon Event ID 1: Process Create for powershell.exe with CommandLine containing 'bxor'. PowerShell ScriptBlock Log Event ID 4104 showing the full XOR encoding/decoding script. No file or network events expected.

Expected Detection

KQL: PowerShellBase64 branch fires (bxor match), ObfuscationMethod='powershell_base64_or_xor'. SPL: PowerShellBase64=1, ObfuscationScore=1. Hunting query for bxor pattern returns this event.

Test 3 Wscript Executing Character-Code Obfuscated VBScript
windows

Executes a VBScript via wscript.exe that uses Chr() function calls — a classic script obfuscation technique to hide string content from static analysis. This pattern appears in malicious macro-embedded documents, drive-by download scripts, and phishing payloads. The Chr() approach allows adversaries to split strings like URLs, registry paths, and command arguments into non-obvious character code sequences.

Command

powershell 
echo WScript.Echo Chr(100) & Chr(102) & Chr(48) & Chr(48) & Chr(116) & Chr(101) & Chr(99) & Chr(104) > %TEMP%\df00tech-chrtest.vbs && wscript.exe %TEMP%\df00tech-chrtest.vbs

Cleanup

powershell 
del %TEMP%\df00tech-chrtest.vbs 2>nul

Expected Telemetry

Sysmon Event ID 1: Process Create for wscript.exe with CommandLine referencing the .vbs file. Sysmon Event ID 11: File Create of the .vbs file in %TEMP%. The script prints 'df00tech' to a WScript dialog — no network or registry events.

Expected Detection

KQL: ScriptObfuscation branch fires on 'chr(' detection with Image=wscript.exe, ObfuscationMethod='script_charcode_obfuscation'. SPL: ScriptCharCode=1, ObfuscationScore=1. Note: this specific test fires on the wscript.exe process creation, not on the cmd.exe that created the file.

Test 4 Cmd.exe Caret Insertion Obfuscation
windows

Demonstrates cmd.exe caret (^) insertion obfuscation, where carets are inserted between characters of a command to defeat string-match signatures while cmd.exe strips them at runtime. This technique is used in malware droppers and living-off-the-land attack chains to evade detection of commands like 'powershell', 'certutil', 'net', or 'tasklist' by breaking up the string with extraneous ^ characters.

Command

powershell 
cmd.exe /c w^h^o^a^m^i

Expected Telemetry

Sysmon Event ID 1: Process Create for cmd.exe with CommandLine containing 'w^h^o^a^m^i' (six carets). Depending on audit configuration, a second Process Create for whoami.exe may appear as a child process. Security Event ID 4688 for cmd.exe and whoami.exe if command line auditing is enabled.

Expected Detection

KQL: CmdObfuscation branch fires on regex match for 4+ caret-character pairs, ObfuscationMethod='cmd_caret_or_var_obfuscation'. SPL: CmdCaretObfusc=1, ObfuscationScore=1. Hunting query for CaretCount >= 6 returns this event (six caret-character pairs in 'w^h^o^a^m^i').

Test 5 Double-Layer PowerShell Base64 Encoding
windows

Creates a two-layer Base64-encoded PowerShell command, simulating the multi-stage obfuscation used by sophisticated malware droppers and post-exploitation frameworks. The outer layer decodes to reveal an inner encoded command — a pattern designed to defeat first-pass deobfuscation and string-based YARA/Sigma rules. Seen in DarkTortilla, Sliver, and various crimeware loaders.

Command

powershell 
powershell.exe -NoProfile -Command "$inner = [Convert]::ToBase64String([System.Text.Encoding]::Unicode.GetBytes('Write-Output df00tech-inner')); $outer = [Convert]::ToBase64String([System.Text.Encoding]::Unicode.GetBytes('[System.Text.Encoding]::Unicode.GetString([Convert]::FromBase64String(''' + $inner + ''')) | Invoke-Expression')); Write-Output ('Double-encoded payload: ' + $outer)"

Expected Telemetry

Sysmon Event ID 1: Process Create for powershell.exe with CommandLine containing 'ToBase64String', 'FromBase64String', and 'Invoke-Expression'. PowerShell ScriptBlock Log Event ID 4104 showing the full encoding script. No file or network events.

Expected Detection

KQL: PowerShellBase64 branch fires on FromBase64String and ToBase64String patterns. SPL: PowerShellBase64=1, ObfuscationScore=1. The nested Base64 hunting query detects this as multi-layer obfuscation if the outer payload is subsequently executed with -EncodedCommand.

Related Detections

Tactic Hub

TA0005Defense Evasion

Sub-techniques (17)

Related Techniques

T1027.001Binary PaddingT1027.002Software PackingT1027.004Compile After DeliveryT1027.006HTML SmugglingT1027.010Command ObfuscationT1027.013Encrypted/Encoded FileT1059.001PowerShellT1059.003Windows Command ShellT1140Deobfuscate/Decode Files or InformationT1204.002Malicious FileT1105Ingress Tool Transfer

Same Tactic: Defense Evasion

Popular Detections