T1027 Google Chronicle · YARA-L

Detect Obfuscated Files or Information in Google Chronicle

Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior used across different platforms and the network to evade defenses. Payloads may be compressed, archived, or encrypted to avoid detection. Portions of files may be encoded to hide plaintext strings. Payloads may be split into separate benign-looking files that only reveal malicious functionality when reassembled. Real-world examples include BackdoorDiplomacy using VMProtect, Ryuk using anti-disassembly and code transformation, Lokibot and Amadey using Base64 string obfuscation, and SVCReady/ECCENTRICBANDWAGON using RC4/XOR encryption.

MITRE ATT&CK

Tactic
Defense Evasion
Technique
T1027 Obfuscated Files or Information
Canonical reference
https://attack.mitre.org/techniques/T1027/

YARA-L Detection Query

Google Chronicle (YARA-L)
yaral 
rule t1027_obfuscated_files_or_information {
  meta:
    author = "Argus Detection Engineering"
    description = "Detects T1027 Obfuscated Files or Information — certutil encode/decode, PowerShell Base64/XOR, script charcode obfuscation, cmd caret/variable expansion."
    mitre_attack_technique = "T1027"
    mitre_attack_tactic = "Defense Evasion"
    severity = "HIGH"
    confidence = "HIGH"
    created = "2026-04-13"
    reference = "https://attack.mitre.org/techniques/T1027/"

  events:
    $e.metadata.event_type = "PROCESS_LAUNCH"
    $e.target.process.file.full_path != ""

    (
      // Branch 1: certutil encode/decode
      (
        re.regex($e.target.process.file.full_path, `(?i)certutil\.exe$`) and
        re.regex($e.target.process.command_line, `(?i)(-decode|-decodehex|-encodehex|-urlcache)`)
      ) or

      // Branch 2: PowerShell Base64/XOR
      (
        re.regex($e.target.process.file.full_path, `(?i)(powershell|pwsh)\.exe$`) and
        re.regex($e.target.process.command_line, `(?i)(FromBase64String|ToBase64String|-EncodedCommand|-enc\s+|-ec\s+|bxor|-bxor)`)
      ) or

      // Branch 3: Script engines with charcode obfuscation
      (
        re.regex($e.target.process.file.full_path, `(?i)(wscript|cscript|mshta)\.exe$`) and
        re.regex($e.target.process.command_line, `(?i)(chr\(|String\.fromCharCode|unescape\(|escape\(|eval\()`)
      ) or

      // Branch 4: cmd.exe caret obfuscation
      (
        re.regex($e.target.process.file.full_path, `(?i)cmd\.exe$`) and
        re.regex($e.target.process.command_line, `(\^[a-zA-Z0-9]){4,}`)
      )
    )

  condition:
    $e
}
high severity high confidence

Chronicle YARA-L 2.0 rule detecting T1027 obfuscation techniques across four branches: certutil encode/decode LOLBin abuse, PowerShell Base64/XOR operations, script engine (wscript/cscript/mshta) charcode obfuscation, and cmd.exe caret/variable-expansion obfuscation. Uses UDM process launch events with regex matching on command line arguments.

Data Sources

Google Chronicle with Windows Sysmon UDM ingestionChronicle with Endpoint Detection sensor data

Required Tables

UDM process events (metadata.event_type = PROCESS_LAUNCH)

False Positives & Tuning

  • PKI administration tasks where certutil.exe legitimately decodes certificate enrollment responses or tests certificate chains
  • Automated Windows administration via PowerShell DSC or scheduled tasks using -EncodedCommand for multiline scripts passed through Task Scheduler
  • Legacy batch scripts from enterprise software vendors (e.g., Oracle Forms, SAP) that use cmd caret escaping for special character handling in install scripts
Download portable Sigma rule (.yml)

Other platforms for T1027

Microsoft Sentinel (KQL) Splunk (SPL) Elastic Security (Elastic) IBM QRadar (QRadar) Sumo Logic CSE (Sumo) CrowdStrike LogScale (LogScale) All platforms (combined) →

Testing Methodology

Validate this detection against 5 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.

  1. Test 1Certutil Base64 Encode and Decode a Payload

    Expected signal: Sysmon Event ID 1: Two Process Create events for certutil.exe — first with CommandLine containing '-encodehex' and output path, second with '-decode' and output path. Sysmon Event ID 11 (File Create): creation of the encoded and decoded output files in %TEMP%. Security Event ID 4688 if command line auditing is enabled. No network events expected for local file operations.

  2. Test 2PowerShell XOR Encoding of a String

    Expected signal: Sysmon Event ID 1: Process Create for powershell.exe with CommandLine containing 'bxor'. PowerShell ScriptBlock Log Event ID 4104 showing the full XOR encoding/decoding script. No file or network events expected.

  3. Test 3Wscript Executing Character-Code Obfuscated VBScript

    Expected signal: Sysmon Event ID 1: Process Create for wscript.exe with CommandLine referencing the .vbs file. Sysmon Event ID 11: File Create of the .vbs file in %TEMP%. The script prints 'df00tech' to a WScript dialog — no network or registry events.

  4. Test 4Cmd.exe Caret Insertion Obfuscation

    Expected signal: Sysmon Event ID 1: Process Create for cmd.exe with CommandLine containing 'w^h^o^a^m^i' (six carets). Depending on audit configuration, a second Process Create for whoami.exe may appear as a child process. Security Event ID 4688 for cmd.exe and whoami.exe if command line auditing is enabled.

  5. Test 5Double-Layer PowerShell Base64 Encoding

    Expected signal: Sysmon Event ID 1: Process Create for powershell.exe with CommandLine containing 'ToBase64String', 'FromBase64String', and 'Invoke-Expression'. PowerShell ScriptBlock Log Event ID 4104 showing the full encoding script. No file or network events.

Last updated: 2026-04-14 Research depth: deep
References (10)

Unlock Pro Content

Get the full detection package for T1027 including response playbook, investigation guide, and atomic red team tests.

Response PlaybookInvestigation GuideHunting QueriesAtomic Red Team TestsTuning Guidance
Sign Up for Pro View Pricing

Related Detections

Sub-techniques (17)

Related Techniques

T1027.001Binary PaddingT1027.002Software PackingT1027.004Compile After DeliveryT1027.006HTML SmugglingT1027.010Command ObfuscationT1027.013Encrypted/Encoded FileT1059.001PowerShellT1059.003Windows Command ShellT1140Deobfuscate/Decode Files or InformationT1204.002Malicious FileT1105Ingress Tool Transfer

Same Tactic: Defense Evasion

Popular Detections