Detect Obfuscated Files or Information in CrowdStrike LogScale
Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior used across different platforms and the network to evade defenses. Payloads may be compressed, archived, or encrypted to avoid detection. Portions of files may be encoded to hide plaintext strings. Payloads may be split into separate benign-looking files that only reveal malicious functionality when reassembled. Real-world examples include BackdoorDiplomacy using VMProtect, Ryuk using anti-disassembly and code transformation, Lokibot and Amadey using Base64 string obfuscation, and SVCReady/ECCENTRICBANDWAGON using RC4/XOR encryption.
MITRE ATT&CK
- Tactic
- Defense Evasion
- Technique
- T1027 Obfuscated Files or Information
- Canonical reference
- https://attack.mitre.org/techniques/T1027/
LogScale Detection Query
// T1027 - Obfuscated Files or Information
// CrowdStrike LogScale (CQL) - Falcon ProcessRollup2 events
#event_simpleName=ProcessRollup2
| FileName = /(?i)(certutil|powershell|pwsh|wscript|cscript|mshta|cmd)\.exe$/
// Certutil encode/decode
| eval certutil_flag = if(
FileName = /(?i)certutil\.exe$/ AND CommandLine = /(?i)(-decode|-decodehex|-encodehex|-urlcache)/,
1, 0
)
// PowerShell Base64/XOR
| eval ps_base64_flag = if(
FileName = /(?i)(powershell|pwsh)\.exe$/ AND
CommandLine = /(?i)(FromBase64String|ToBase64String|-EncodedCommand|-enc\s|-ec\s|bxor|-bxor)/,
1, 0
)
// Script charcode obfuscation
| eval script_charcode_flag = if(
FileName = /(?i)(wscript|cscript|mshta)\.exe$/ AND
CommandLine = /(?i)(chr\(|String\.fromCharCode|unescape\(|escape\(|eval\()/,
1, 0
)
// cmd.exe caret obfuscation
| eval cmd_caret_flag = if(
FileName = /(?i)cmd\.exe$/ AND
CommandLine = /(\^[a-zA-Z0-9]){4,}/,
1, 0
)
| eval obfuscation_score = certutil_flag + ps_base64_flag + script_charcode_flag + cmd_caret_flag
| where obfuscation_score > 0
| eval obfuscation_methods = array:concat(
if(certutil_flag = 1, ["certutil_encode_decode"], []),
if(ps_base64_flag = 1, ["ps_base64_xor"], []),
if(script_charcode_flag = 1, ["script_charcode"], []),
if(cmd_caret_flag = 1, ["cmd_caret"], [])
)
| table(
[@timestamp, ComputerName, UserName, FileName, CommandLine,
ParentBaseFileName, ParentCommandLine,
certutil_flag, ps_base64_flag, script_charcode_flag, cmd_caret_flag,
obfuscation_methods, obfuscation_score],
sortby=obfuscation_score,
order=desc,
limit=1000
)CrowdStrike LogScale (Falcon CQL) detection for T1027 obfuscated files or information. Queries ProcessRollup2 events from the Falcon sensor targeting certutil encode/decode, PowerShell Base64/XOR, script engine charcode obfuscation, and cmd.exe caret obfuscation. Produces a scored, categorized result set ordered by severity.
Data Sources
Required Tables
False Positives & Tuning
- Patch management solutions (SCCM, Intune, Ivanti) invoking certutil to download and decode update packages as part of legitimate software distribution workflows
- DevOps CI/CD pipelines using PowerShell with -EncodedCommand to pass complex multiline build scripts through Azure DevOps or Jenkins agents
- System hardening or compliance scripts from vendors like CIS-CAT or Tenable that use cmd.exe with variable expansion for dynamic environment detection
Other platforms for T1027
Testing Methodology
Validate this detection against 5 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Certutil Base64 Encode and Decode a Payload
Expected signal: Sysmon Event ID 1: Two Process Create events for certutil.exe — first with CommandLine containing '-encodehex' and output path, second with '-decode' and output path. Sysmon Event ID 11 (File Create): creation of the encoded and decoded output files in %TEMP%. Security Event ID 4688 if command line auditing is enabled. No network events expected for local file operations.
- Test 2PowerShell XOR Encoding of a String
Expected signal: Sysmon Event ID 1: Process Create for powershell.exe with CommandLine containing 'bxor'. PowerShell ScriptBlock Log Event ID 4104 showing the full XOR encoding/decoding script. No file or network events expected.
- Test 3Wscript Executing Character-Code Obfuscated VBScript
Expected signal: Sysmon Event ID 1: Process Create for wscript.exe with CommandLine referencing the .vbs file. Sysmon Event ID 11: File Create of the .vbs file in %TEMP%. The script prints 'df00tech' to a WScript dialog — no network or registry events.
- Test 4Cmd.exe Caret Insertion Obfuscation
Expected signal: Sysmon Event ID 1: Process Create for cmd.exe with CommandLine containing 'w^h^o^a^m^i' (six carets). Depending on audit configuration, a second Process Create for whoami.exe may appear as a child process. Security Event ID 4688 for cmd.exe and whoami.exe if command line auditing is enabled.
- Test 5Double-Layer PowerShell Base64 Encoding
Expected signal: Sysmon Event ID 1: Process Create for powershell.exe with CommandLine containing 'ToBase64String', 'FromBase64String', and 'Invoke-Expression'. PowerShell ScriptBlock Log Event ID 4104 showing the full encoding script. No file or network events.
References (10)
- https://attack.mitre.org/techniques/T1027/
- https://www.welivesecurity.com/2021/06/10/backdoordiplomacy-upgrading-quarian-to-turian/
- https://www.microsoft.com/en-us/security/blog/2022/08/24/looking-for-the-sliver-lining-hunting-for-emerging-command-and-control-frameworks/
- https://web.archive.org/web/20170923102302/https://www.fireeye.com/blog/threat-research/2017/06/obfuscation-in-the-wild.html
- https://github.com/danielbohannon/Revoke-Obfuscation
- https://www.blackhat.com/docs/us-17/thursday/us-17-Bohannon-Revoke-Obfuscation-PowerShell-Obfuscation-Detection-And%20Evasion-Using-Science-wp.pdf
- https://researchcenter.paloaltonetworks.com/2017/03/unit42-pulling-back-the-curtains-on-encodedcommand-powershell-attacks/
- https://learn.microsoft.com/en-us/defender-endpoint/advanced-hunting-deviceprocessevents-table
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1027/T1027.md
- https://www.secureworks.com/research/darktortilla-malware-analysis
Unlock Pro Content
Get the full detection package for T1027 including response playbook, investigation guide, and atomic red team tests.
Related Detections
Sub-techniques (17)
- T1027.001Binary Padding
- T1027.002Software Packing
- T1027.003Steganography
- T1027.004Compile After Delivery
- T1027.005Indicator Removal from Tools
- T1027.006HTML Smuggling
- T1027.007Dynamic API Resolution
- T1027.008Stripped Payloads
- T1027.009Embedded Payloads
- T1027.010Command Obfuscation
- T1027.011Fileless Storage
- T1027.012LNK Icon Smuggling
- T1027.013Encrypted/Encoded File
- T1027.014Polymorphic Code
- T1027.015Compression
- T1027.016Junk Code Insertion
- T1027.017SVG Smuggling