Detect Obfuscated Files or Information in Splunk
Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior used across different platforms and the network to evade defenses. Payloads may be compressed, archived, or encrypted to avoid detection. Portions of files may be encoded to hide plaintext strings. Payloads may be split into separate benign-looking files that only reveal malicious functionality when reassembled. Real-world examples include BackdoorDiplomacy using VMProtect, Ryuk using anti-disassembly and code transformation, Lokibot and Amadey using Base64 string obfuscation, and SVCReady/ECCENTRICBANDWAGON using RC4/XOR encryption.
MITRE ATT&CK
- Tactic
- Defense Evasion
- Technique
- T1027 Obfuscated Files or Information
- Canonical reference
- https://attack.mitre.org/techniques/T1027/
SPL Detection Query
index=wineventlog (sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1)
(Image="*\\certutil.exe" OR Image="*\\powershell.exe" OR Image="*\\pwsh.exe"
OR Image="*\\wscript.exe" OR Image="*\\cscript.exe" OR Image="*\\mshta.exe"
OR Image="*\\cmd.exe")
| eval CommandLineLower=lower(CommandLine)
| eval CertutilDecode=if(match(Image, "certutil\.exe") AND match(CommandLineLower, "(-decode|-decodehex|-encodehex|-urlcache)"), 1, 0)
| eval PowerShellBase64=if(match(Image, "(powershell|pwsh)\.exe") AND match(CommandLineLower, "(frombase64string|tobase64string|-encodedcommand|-enc\s+|-ec\s+|bxor|-bxor)"), 1, 0)
| eval ScriptCharCode=if(match(Image, "(wscript|cscript|mshta)\.exe") AND match(CommandLineLower, "(chr\(|string\.fromcharcode|unescape\(|escape\(|eval\()"), 1, 0)
| eval CmdCaretObfusc=if(match(Image, "cmd\.exe") AND match(CommandLine, "(\^[a-zA-Z0-9]){4,}"), 1, 0)
| eval CmdVarObfusc=if(match(Image, "cmd\.exe") AND match(CommandLine, "(%[a-zA-Z_][a-zA-Z0-9_]*:~[0-9]+,[0-9]+%){3,}"), 1, 0)
| eval ObfuscationScore=CertutilDecode + PowerShellBase64 + ScriptCharCode + CmdCaretObfusc + CmdVarObfusc
| eval ObfuscationMethods=mvappend(
if(CertutilDecode=1, "certutil_encode_decode", null()),
if(PowerShellBase64=1, "ps_base64_xor", null()),
if(ScriptCharCode=1, "script_charcode", null()),
if(CmdCaretObfusc=1, "cmd_caret", null()),
if(CmdVarObfusc=1, "cmd_var_substring", null())
)
| where ObfuscationScore > 0
| table _time, host, User, Image, CommandLine, ParentImage, ParentCommandLine,
CertutilDecode, PowerShellBase64, ScriptCharCode, CmdCaretObfusc, CmdVarObfusc,
ObfuscationMethods, ObfuscationScore
| sort - ObfuscationScore, - _timeDetects obfuscated file and information patterns using Sysmon Event ID 1 (Process Creation) logs across certutil.exe, PowerShell, script interpreters, and cmd.exe. Assigns categorical flags per obfuscation method and aggregates them into an ObfuscationScore to surface the most suspicious entries first. CertutilDecode=1 flags certutil encoding/decoding abuse. PowerShellBase64=1 flags Base64 or XOR obfuscation in PowerShell. ScriptCharCode=1 flags character-code obfuscation in scripting hosts. CmdCaretObfusc and CmdVarObfusc flag cmd.exe shell obfuscation techniques.
Data Sources
Required Sourcetypes
False Positives & Tuning
- Software build pipelines and CI/CD agents routinely use certutil and PowerShell Base64 for encoding configuration artifacts
- IT management platforms (SCCM, PDQ, Ansible) pass encoded parameters to PowerShell for safe string handling during software deployment
- Security analysts running detection engineering or malware triage scripts on designated analysis machines
- Developer workstations where JavaScript unescape() or eval() calls appear in test/debug scripts run via cscript.exe
- Backup software and archive tools that combine compression with Base64 encoding for transport
Other platforms for T1027
Testing Methodology
Validate this detection against 5 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Certutil Base64 Encode and Decode a Payload
Expected signal: Sysmon Event ID 1: Two Process Create events for certutil.exe — first with CommandLine containing '-encodehex' and output path, second with '-decode' and output path. Sysmon Event ID 11 (File Create): creation of the encoded and decoded output files in %TEMP%. Security Event ID 4688 if command line auditing is enabled. No network events expected for local file operations.
- Test 2PowerShell XOR Encoding of a String
Expected signal: Sysmon Event ID 1: Process Create for powershell.exe with CommandLine containing 'bxor'. PowerShell ScriptBlock Log Event ID 4104 showing the full XOR encoding/decoding script. No file or network events expected.
- Test 3Wscript Executing Character-Code Obfuscated VBScript
Expected signal: Sysmon Event ID 1: Process Create for wscript.exe with CommandLine referencing the .vbs file. Sysmon Event ID 11: File Create of the .vbs file in %TEMP%. The script prints 'df00tech' to a WScript dialog — no network or registry events.
- Test 4Cmd.exe Caret Insertion Obfuscation
Expected signal: Sysmon Event ID 1: Process Create for cmd.exe with CommandLine containing 'w^h^o^a^m^i' (six carets). Depending on audit configuration, a second Process Create for whoami.exe may appear as a child process. Security Event ID 4688 for cmd.exe and whoami.exe if command line auditing is enabled.
- Test 5Double-Layer PowerShell Base64 Encoding
Expected signal: Sysmon Event ID 1: Process Create for powershell.exe with CommandLine containing 'ToBase64String', 'FromBase64String', and 'Invoke-Expression'. PowerShell ScriptBlock Log Event ID 4104 showing the full encoding script. No file or network events.
References (10)
- https://attack.mitre.org/techniques/T1027/
- https://www.welivesecurity.com/2021/06/10/backdoordiplomacy-upgrading-quarian-to-turian/
- https://www.microsoft.com/en-us/security/blog/2022/08/24/looking-for-the-sliver-lining-hunting-for-emerging-command-and-control-frameworks/
- https://web.archive.org/web/20170923102302/https://www.fireeye.com/blog/threat-research/2017/06/obfuscation-in-the-wild.html
- https://github.com/danielbohannon/Revoke-Obfuscation
- https://www.blackhat.com/docs/us-17/thursday/us-17-Bohannon-Revoke-Obfuscation-PowerShell-Obfuscation-Detection-And%20Evasion-Using-Science-wp.pdf
- https://researchcenter.paloaltonetworks.com/2017/03/unit42-pulling-back-the-curtains-on-encodedcommand-powershell-attacks/
- https://learn.microsoft.com/en-us/defender-endpoint/advanced-hunting-deviceprocessevents-table
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1027/T1027.md
- https://www.secureworks.com/research/darktortilla-malware-analysis
Unlock Pro Content
Get the full detection package for T1027 including response playbook, investigation guide, and atomic red team tests.
Related Detections
Sub-techniques (17)
- T1027.001Binary Padding
- T1027.002Software Packing
- T1027.003Steganography
- T1027.004Compile After Delivery
- T1027.005Indicator Removal from Tools
- T1027.006HTML Smuggling
- T1027.007Dynamic API Resolution
- T1027.008Stripped Payloads
- T1027.009Embedded Payloads
- T1027.010Command Obfuscation
- T1027.011Fileless Storage
- T1027.012LNK Icon Smuggling
- T1027.013Encrypted/Encoded File
- T1027.014Polymorphic Code
- T1027.015Compression
- T1027.016Junk Code Insertion
- T1027.017SVG Smuggling