Which SIEM platforms have a T1027 detection rule?

df00tech provides T1027 (Obfuscated Files or Information) detection queries for 7 SIEM platforms: Microsoft Sentinel / Defender, Splunk, Elastic Security (EQL), IBM QRadar (AQL), Sumo Logic CSE, Google Chronicle / SecOps, CrowdStrike LogScale (CQL).

What data sources are required to detect Obfuscated Files or Information (T1027)?

Detecting Obfuscated Files or Information requires the following data sources: Process: Process Creation, Command: Command Execution, Microsoft Defender for Endpoint.

What severity and confidence is the T1027 detection?

The T1027 detection is rated medium severity with medium confidence.

What are common false positives for T1027?

Common false positives for T1027 include: Software developers and build pipelines routinely call certutil -encodehex or PowerShell Base64 operations as part of legitimate encoding/decoding workflows; IT automation tools (SCCM, Ansible, Intune) often pass encoded configuration blobs to PowerShell as a safe way to handle special characters in installation scripts; Security tools and scanners themselves may decode malware samples as part of analysis pipelines on analyst workstations.

T1027 IBM QRadar · QRadar

Detect Obfuscated Files or Information in IBM QRadar

Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior used across different platforms and the network to evade defenses. Payloads may be compressed, archived, or encrypted to avoid detection. Portions of files may be encoded to hide plaintext strings. Payloads may be split into separate benign-looking files that only reveal malicious functionality when reassembled. Real-world examples include BackdoorDiplomacy using VMProtect, Ryuk using anti-disassembly and code transformation, Lokibot and Amadey using Base64 string obfuscation, and SVCReady/ECCENTRICBANDWAGON using RC4/XOR encryption.

MITRE ATT&CK

Tactic: Defense Evasion
Technique: T1027 Obfuscated Files or Information
Canonical reference: https://attack.mitre.org/techniques/T1027/

QRadar Detection Query

IBM QRadar (QRadar)

sql

SELECT
  DATEFORMAT(devicetime, 'yyyy-MM-dd HH:mm:ss') AS event_time,
  sourceip,
  username,
  "TargetUserName",
  QIDNAME(qid) AS event_name,
  LOGSOURCENAME(logsourceid) AS log_source,
  "CommandLine",
  "ParentCommandLine",
  "Image" AS process_image,
  "ParentImage" AS parent_image,
  CASE
    WHEN LOWER("Image") LIKE '%certutil.exe' AND (
      LOWER("CommandLine") LIKE '%-decode%' OR
      LOWER("CommandLine") LIKE '%-decodehex%' OR
      LOWER("CommandLine") LIKE '%-encodehex%' OR
      LOWER("CommandLine") LIKE '%-urlcache%'
    ) THEN 'certutil_encode_decode'
    WHEN (LOWER("Image") LIKE '%powershell.exe' OR LOWER("Image") LIKE '%pwsh.exe') AND (
      LOWER("CommandLine") LIKE '%frombase64string%' OR
      LOWER("CommandLine") LIKE '%tobase64string%' OR
      LOWER("CommandLine") LIKE '%-encodedcommand%' OR
      LOWER("CommandLine") LIKE '%-enc %' OR
      LOWER("CommandLine") LIKE '%bxor%'
    ) THEN 'powershell_base64_xor'
    WHEN (LOWER("Image") LIKE '%wscript.exe' OR LOWER("Image") LIKE '%cscript.exe' OR LOWER("Image") LIKE '%mshta.exe') AND (
      LOWER("CommandLine") LIKE '%chr(%' OR
      LOWER("CommandLine") LIKE '%string.fromcharcode%' OR
      LOWER("CommandLine") LIKE '%unescape(%' OR
      LOWER("CommandLine") LIKE '%eval(%'
    ) THEN 'script_charcode_obfuscation'
    WHEN LOWER("Image") LIKE '%cmd.exe' AND (
      "CommandLine" LIKE '%^_^_^_^_%' OR
      "CommandLine" LIKE '%%*:~*,*%*:~*,*%%'
    ) THEN 'cmd_caret_or_var_obfuscation'
    ELSE 'unknown'
  END AS obfuscation_method
FROM events
WHERE
  devicetime > NOW() - 86400000
  AND LOGSOURCETYPEID IN (12, 433)
  AND (
    ("EventID" = '1' OR "EventID" = '4688')
  )
  AND (
    LOWER("Image") LIKE '%certutil.exe' OR
    LOWER("Image") LIKE '%powershell.exe' OR
    LOWER("Image") LIKE '%pwsh.exe' OR
    LOWER("Image") LIKE '%wscript.exe' OR
    LOWER("Image") LIKE '%cscript.exe' OR
    LOWER("Image") LIKE '%mshta.exe' OR
    LOWER("Image") LIKE '%cmd.exe'
  )
  AND (
    (LOWER("Image") LIKE '%certutil.exe' AND (
      LOWER("CommandLine") LIKE '%-decode%' OR LOWER("CommandLine") LIKE '%-encodehex%' OR LOWER("CommandLine") LIKE '%-urlcache%'
    )) OR
    ((LOWER("Image") LIKE '%powershell.exe' OR LOWER("Image") LIKE '%pwsh.exe') AND (
      LOWER("CommandLine") LIKE '%frombase64string%' OR LOWER("CommandLine") LIKE '%-encodedcommand%' OR
      LOWER("CommandLine") LIKE '%bxor%' OR LOWER("CommandLine") LIKE '%-enc %'
    )) OR
    ((LOWER("Image") LIKE '%wscript.exe' OR LOWER("Image") LIKE '%cscript.exe' OR LOWER("Image") LIKE '%mshta.exe') AND (
      LOWER("CommandLine") LIKE '%chr(%' OR LOWER("CommandLine") LIKE '%fromcharcode%' OR LOWER("CommandLine") LIKE '%eval(%'
    )) OR
    (LOWER("Image") LIKE '%cmd.exe' AND LOWER("CommandLine") LIKE '%^%^%^%^%')
  )
ORDER BY devicetime DESC

high severity medium confidence

Detects T1027 obfuscation techniques via Sysmon EventID 1 (Process Create) or Security EventID 4688 in QRadar. Flags certutil decode/encode operations, PowerShell Base64/XOR, script engine charcode obfuscation, and cmd.exe caret/variable-expansion abuse. Uses AQL CASE expression to categorize the obfuscation method.

Data Sources

QRadar SIEM with Windows Sysmon log source (LOGSOURCETYPEID 433)Windows Security Event log source (LOGSOURCETYPEID 12)

Required Tables

events

False Positives & Tuning

System administrators using certutil for PKI certificate management or WSUS operations that involve file decode steps
Automated deployment pipelines (Ansible, Chef, Puppet) that pass Base64-encoded configuration blobs via PowerShell
Legacy web automation scripts using cscript with eval() or String.fromCharCode() for encoding compatibility

Download portable Sigma rule (.yml)

Other platforms for T1027

Microsoft Sentinel (KQL) Splunk (SPL) Elastic Security (Elastic) Sumo Logic CSE (Sumo) Google Chronicle (YARA-L) CrowdStrike LogScale (LogScale) All platforms (combined) →

Testing Methodology

Validate this detection against 5 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.

Test 1Certutil Base64 Encode and Decode a Payload
Expected signal: Sysmon Event ID 1: Two Process Create events for certutil.exe — first with CommandLine containing '-encodehex' and output path, second with '-decode' and output path. Sysmon Event ID 11 (File Create): creation of the encoded and decoded output files in %TEMP%. Security Event ID 4688 if command line auditing is enabled. No network events expected for local file operations.
Test 2PowerShell XOR Encoding of a String
Expected signal: Sysmon Event ID 1: Process Create for powershell.exe with CommandLine containing 'bxor'. PowerShell ScriptBlock Log Event ID 4104 showing the full XOR encoding/decoding script. No file or network events expected.
Test 3Wscript Executing Character-Code Obfuscated VBScript
Expected signal: Sysmon Event ID 1: Process Create for wscript.exe with CommandLine referencing the .vbs file. Sysmon Event ID 11: File Create of the .vbs file in %TEMP%. The script prints 'df00tech' to a WScript dialog — no network or registry events.
Test 4Cmd.exe Caret Insertion Obfuscation
Expected signal: Sysmon Event ID 1: Process Create for cmd.exe with CommandLine containing 'w^h^o^a^m^i' (six carets). Depending on audit configuration, a second Process Create for whoami.exe may appear as a child process. Security Event ID 4688 for cmd.exe and whoami.exe if command line auditing is enabled.
Test 5Double-Layer PowerShell Base64 Encoding
Expected signal: Sysmon Event ID 1: Process Create for powershell.exe with CommandLine containing 'ToBase64String', 'FromBase64String', and 'Invoke-Expression'. PowerShell ScriptBlock Log Event ID 4104 showing the full encoding script. No file or network events.

Last updated: 2026-04-14 Research depth: deep

References (10)

Response Playbook

1. Examine the full command line and decode any Base64 content...
2. Identify the parent process chain and user context...
3. Check for concurrent network connections from the process...

Investigation Guide

Related techniques: T1027, T1105, T1562.001...
Forensic artifacts: PSReadLine history, Prefetch, ScriptBlock logs...

Atomic Red Team Tests

Test 1: Encoded command execution...
Test 2: Download cradle via Net.WebClient...

Unlock Pro Content

Get the full detection package for T1027 including response playbook, investigation guide, and atomic red team tests.

Response PlaybookInvestigation GuideHunting QueriesAtomic Red Team TestsTuning Guidance

Related Detections

Sub-techniques (17)

Related Techniques

T1027.001Binary Padding T1027.002Software Packing T1027.004Compile After Delivery T1027.006HTML Smuggling T1027.010Command Obfuscation T1027.013Encrypted/Encoded File T1059.001PowerShell T1059.003Windows Command Shell T1140Deobfuscate/Decode Files or Information T1204.002Malicious File T1105Ingress Tool Transfer

Detect Obfuscated Files or Information in IBM QRadar

MITRE ATT&CK

QRadar Detection Query

Data Sources

Required Tables

False Positives & Tuning

Other platforms for T1027

Testing Methodology

Response Playbook

Investigation Guide

Atomic Red Team Tests

Unlock Pro Content

Related Detections

Sub-techniques (17)

Related Techniques

Same Tactic: Defense Evasion

Popular Detections

MITRE ATT&CK

QRadar Detection Query

Data Sources

Required Tables

False Positives & Tuning

Other platforms for T1027

Testing Methodology

Unlock Pro Content

Related Detections

Sub-techniques (17)

Related Techniques

Same Tactic: Defense Evasion

Popular Detections

Get new detections in your inbox