Response playbooks, investigation guides, and Atomic Red Team tests are Pro-only. Upgrade to unlock the full detection package for T1027.013.
Upgrade to ProDetect Encrypted/Encoded File in Splunk
This detection identifies adversary use of encrypted or encoded files to conceal malicious payloads, configurations, or command-and-control artifacts from static analysis and signature-based detection. Adversaries commonly apply Base64 encoding, XOR ciphers, AES/RC4 encryption, or layered encoding schemes to files dropped on victim hosts, phishing attachments (password-protected documents, self-extracting archives), or scripts that decode and execute payloads at runtime. Detection focuses on processes decoding or decrypting file content, suspicious file entropy indicators surfaced via tooling, script interpreters reading encoded blobs, and the creation of high-entropy files in user-writable directories.
MITRE ATT&CK
- Tactic
- Defense Evasion
- Technique
- T1027 Obfuscated Files or Information
- Sub-technique
- T1027.013 Encrypted/Encoded File
- Canonical reference
- https://attack.mitre.org/techniques/T1027/013/
SPL Detection Query
index=* (sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1) OR (sourcetype="WinEventLog:Security" EventCode=4688)
| eval cmdline=coalesce(CommandLine, Process_Command_Line)
| eval proc=coalesce(Image, New_Process_Name)
| search cmdline IN ("*certutil*-decode*", "*certutil*-decodehex*", "*FromBase64String*", "*-EncodedCommand*", "*[Convert]::FromBase64*", "*openssl enc*", "*openssl base64*", "*base64 -d*", "*base64 -D*", "*-enc *")
| eval suspicious_proc=if(match(proc, "(?i)(certutil|powershell|pwsh|python|wscript|cscript|mshta)"), 1, 0)
| where suspicious_proc=1
| eval cmdline_len=len(cmdline)
| where cmdline_len > 100
| stats count by _time, host, proc, cmdline, User
| sort -_timeDetects file decoding and decryption operations via Sysmon process creation (Event 1) and Windows Security audit process creation (Event 4688), targeting certutil, PowerShell, and script interpreters executing known Base64/encoding decode patterns.
Data Sources
Required Sourcetypes
False Positives & Tuning
- IT administrators using certutil to manage certificates and decode DER/PEM files
- Legitimate automation scripts using PowerShell base64 encoding for data transfer
- Python-based developer tools that serialize/deserialize base64-encoded content
Other platforms for T1027.013
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1certutil Base64 Decode to Disk
Expected signal: DeviceProcessEvents: certutil.exe with -decode argument; Sysmon Event ID 1 with CommandLine containing '-decode'; Sysmon Event ID 11 showing decoded_payload.bin creation in C:\Windows\Temp
- Test 2PowerShell In-Memory Base64 Payload Decode
Expected signal: DeviceProcessEvents: powershell.exe with FromBase64String in command line; PowerShell Script Block Log Event ID 4104 containing FromBase64String and [Convert]::FromBase64; Sysmon Event ID 11 for decoded_ps_payload.bin creation
- Test 3OpenSSL AES Decrypt File on Linux
Expected signal: Linux auditd execve syscall records for base64 and openssl processes; Syslog entries for process execution; Elastic Auditbeat process events showing openssl enc -d with -aes-256-cbc arguments; file creation event for decrypted_payload.bin in /tmp
References (7)
- https://attack.mitre.org/techniques/T1027/013/
- https://www.mandiant.com/resources/apt41-initiating-footholds
- https://www.mcafee.com/blogs/other-blogs/mcafee-labs/operation-north-star-a-job-offer-thats-too-good-to-be-true/
- https://www.trendmicro.com/en_us/research/18/d/new-macos-backdoor-linked-to-oceanlotus-found.html
- https://securelist.com/cloud-atlas-redoctober-apt-is-back-in-style/68083/
- https://www.welivesecurity.com/2014/11/11/sednit-espionage-group-attacking-air-gapped-networks/
- https://www.hhs.gov/sites/default/files/qilin-threat-profile.pdf
Unlock playbooks & atomic tests with Pro
Get the full detection package for T1027.013 — response playbook and atomic red team tests, plus investigation guidance and hunting queries.
df00tech Pro — £29/user/month