Which SIEM platforms have a T1140 detection rule?

df00tech provides T1140 (Deobfuscate/Decode Files or Information) detection queries for 7 SIEM platforms: Microsoft Sentinel / Defender, Splunk, Elastic Security (EQL), IBM QRadar (AQL), Sumo Logic CSE, Google Chronicle / SecOps, CrowdStrike LogScale (CQL).

What data sources are required to detect Deobfuscate/Decode Files or Information (T1140)?

Detecting Deobfuscate/Decode Files or Information requires the following data sources: Process: Process Creation, Command: Command Execution, Microsoft Defender for Endpoint.

What severity and confidence is the T1140 detection?

The T1140 detection is rated medium severity with high confidence.

What are common false positives for T1140?

Common false positives for T1140 include: Software installation scripts using certutil to download and decode legitimate certificate files during provisioning workflows; IT automation tools (SCCM, Ansible, Chef) using PowerShell Base64 encoding to safely pass configuration parameters that contain special characters; Security scanning or vulnerability assessment tools that use certutil for certificate chain validation and CRL download.

T1140

Deobfuscate/Decode Files or Information

Defense Evasion Last updated: April 18, 2026

Adversaries may use Obfuscated Files or Information to conceal artifacts of an intrusion. They require separate mechanisms to decode or deobfuscate that information before use. Common methods include using certutil.exe to Base64-decode payloads disguised as certificate files, PowerShell's [Convert]::FromBase64String() to decode strings in memory, cmd.exe copy /b or type commands to reassemble binary fragments, and scripting languages (Python, VBScript) to perform XOR or RC4 decryption at runtime. These techniques allow adversaries to bypass static signature detection by staging encoded payloads and decoding them only at execution time.

What is T1140 Deobfuscate/Decode Files or Information?

Deobfuscate/Decode Files or Information (T1140) maps to the Defense Evasion tactic — the adversary is trying to avoid being detected in MITRE ATT&CK.

This page provides production-ready detection logic for Deobfuscate/Decode Files or Information, covering the data sources and telemetry it touches: Process: Process Creation, Command: Command Execution, Microsoft Defender for Endpoint. The queries below are rated medium severity at high confidence, and ship for 7 SIEM platforms — KQL, SPL, Elastic, QRadar, Sumo, YARA-L, LogScale.

MITRE ATT&CK

Tactic: Defense Evasion
Technique: T1140 Deobfuscate/Decode Files or Information
Canonical reference: https://attack.mitre.org/techniques/T1140/

Microsoft Sentinel / Defender

kusto

let CertutilDecodePatterns = dynamic([
  "-decode", "-decodehex", "-urlcache", "-f -split", "-decodetohex"
]);
let PowerShellDecodePatterns = dynamic([
  "FromBase64String", "[Convert]::", "[System.Convert]::",
  "IO.MemoryStream", "GZipStream", "DeflateStream",
  "System.IO.Compression", "::Decompress"
]);
let CmdReassemblyPatterns = dynamic([
  "copy /b", "type ", "copy /B"
]);
let OtherDecodeTools = dynamic([
  "expand.exe", "extrac32.exe", "certutil"
]);
// Branch 1: certutil decode activity
let CertutilEvents = DeviceProcessEvents
| where Timestamp > ago(24h)
| where FileName =~ "certutil.exe"
| where ProcessCommandLine has_any (CertutilDecodePatterns)
| extend DecodeMethod = "certutil"
| extend Indicator = extract(@"(-decode|-decodehex|-urlcache|-split)", 0, tolower(ProcessCommandLine))
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine,
         InitiatingProcessFileName, InitiatingProcessCommandLine,
         InitiatingProcessAccountName, FolderPath, DecodeMethod, Indicator;
// Branch 2: PowerShell in-memory decode/decompress
let PSDecodeEvents = DeviceProcessEvents
| where Timestamp > ago(24h)
| where FileName in~ ("powershell.exe", "pwsh.exe")
| where ProcessCommandLine has_any (PowerShellDecodePatterns)
| extend DecodeMethod = "powershell-base64"
| extend Indicator = case(
    ProcessCommandLine has "FromBase64String", "FromBase64String",
    ProcessCommandLine has "GZipStream", "GZip-Decompress",
    ProcessCommandLine has "DeflateStream", "Deflate-Decompress",
    "base64-decode"
  )
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine,
         InitiatingProcessFileName, InitiatingProcessCommandLine,
         InitiatingProcessAccountName, FolderPath, DecodeMethod, Indicator;
// Branch 3: cmd.exe binary fragment reassembly
let CmdReassemblyEvents = DeviceProcessEvents
| where Timestamp > ago(24h)
| where FileName =~ "cmd.exe"
| where ProcessCommandLine has "copy /b" or ProcessCommandLine has "copy /B"
| where ProcessCommandLine matches regex @"copy\s+/[bB].*\.(bin|dat|txt|jpg|png|pdf|tmp|log)"
| extend DecodeMethod = "cmd-copy-reassembly"
| extend Indicator = "binary-fragment-reassembly"
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine,
         InitiatingProcessFileName, InitiatingProcessCommandLine,
         InitiatingProcessAccountName, FolderPath, DecodeMethod, Indicator;
// Branch 4: expand.exe / extrac32 abuse for CAB extraction of hidden payloads
let ExpandEvents = DeviceProcessEvents
| where Timestamp > ago(24h)
| where FileName in~ ("expand.exe", "extrac32.exe")
| where ProcessCommandLine matches regex @"\.(cab|zip|dat|bin|txt|jpg|png|tmp)"
| extend DecodeMethod = FileName
| extend Indicator = "lolbin-cab-extract"
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine,
         InitiatingProcessFileName, InitiatingProcessCommandLine,
         InitiatingProcessAccountName, FolderPath, DecodeMethod, Indicator;
// Union all branches and enrich
CertutilEvents
| union PSDecodeEvents, CmdReassemblyEvents, ExpandEvents
| extend SuspiciousParent = InitiatingProcessFileName in~ (
    "wscript.exe", "cscript.exe", "mshta.exe", "winword.exe",
    "excel.exe", "outlook.exe", "rundll32.exe", "regsvr32.exe",
    "msbuild.exe", "installutil.exe", "regasm.exe"
  )
| extend HighPrivilege = AccountName in~ ("SYSTEM", "Administrator") or
    InitiatingProcessAccountName in~ ("SYSTEM", "Administrator")
| extend RiskScore = case(
    SuspiciousParent and HighPrivilege, 3,
    SuspiciousParent or HighPrivilege, 2,
    1
  )
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine,
         InitiatingProcessFileName, InitiatingProcessCommandLine,
         DecodeMethod, Indicator, SuspiciousParent, HighPrivilege, RiskScore
| sort by RiskScore desc, Timestamp desc

Detects deobfuscation and decoding activity using multiple vectors: (1) certutil.exe with -decode/-decodehex flags commonly used to decode Base64-encoded payloads embedded in fake certificate files; (2) PowerShell FromBase64String, GZipStream, and DeflateStream patterns indicating in-memory decode/decompress chains; (3) cmd.exe copy /b binary fragment reassembly to reconstruct malicious payloads split across innocuous-looking files; (4) expand.exe and extrac32.exe abuse to extract payloads from CAB archives disguised as common file types. Results are scored by parent process risk and privilege context.

medium severity high confidence

Data Sources

Process: Process Creation Command: Command Execution Microsoft Defender for Endpoint

Required Tables

DeviceProcessEvents

False Positives

Software installation scripts using certutil to download and decode legitimate certificate files during provisioning workflows
IT automation tools (SCCM, Ansible, Chef) using PowerShell Base64 encoding to safely pass configuration parameters that contain special characters
Security scanning or vulnerability assessment tools that use certutil for certificate chain validation and CRL download
Legitimate software updaters that use expand.exe or extrac32.exe to unpack update packages delivered as CAB files
Developers testing encoding/decoding routines on workstations — typically identifiable by IDE parent processes and developer machine naming conventions

Splunk

spl

index=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1
(
  (Image="*\\certutil.exe" AND (CommandLine="*-decode*" OR CommandLine="*-decodehex*" OR CommandLine="*-urlcache*"))
  OR (Image="*\\powershell.exe" OR Image="*\\pwsh.exe") AND
     (CommandLine="*FromBase64String*" OR CommandLine="*GZipStream*" OR CommandLine="*DeflateStream*" OR CommandLine="*IO.MemoryStream*" OR CommandLine="*IO.Compression*")
  OR (Image="*\\cmd.exe" AND CommandLine="*copy /b*")
  OR (Image="*\\expand.exe" OR Image="*\\extrac32.exe")
)
| eval DecodeMethod=case(
    match(Image, "certutil\.exe") AND match(lower(CommandLine), "(-decode|-decodehex|-urlcache)"), "certutil-decode",
    match(Image, "powershell\.exe|pwsh\.exe") AND match(CommandLine, "FromBase64String"), "ps-base64-decode",
    match(Image, "powershell\.exe|pwsh\.exe") AND match(CommandLine, "GZipStream|DeflateStream"), "ps-decompress",
    match(Image, "cmd\.exe") AND match(lower(CommandLine), "copy /b"), "cmd-binary-reassembly",
    match(Image, "expand\.exe|extrac32\.exe"), "lolbin-cab-extract",
    "unknown"
  )
| eval SuspiciousParent=if(
    match(ParentImage, "wscript\.exe|cscript\.exe|mshta\.exe|winword\.exe|excel\.exe|outlook\.exe|rundll32\.exe|regsvr32\.exe|msbuild\.exe|installutil\.exe"),
    1, 0
  )
| eval HighPrivilege=if(match(User, "(?i)(system|administrator|SYSTEM)"), 1, 0)
| eval WritesToSuspiciousPath=if(
    match(lower(CommandLine), "(temp|tmp|appdata|public|programdata|recycle)"),
    1, 0
  )
| eval RiskScore=SuspiciousParent*2 + HighPrivilege + WritesToSuspiciousPath
| where DecodeMethod != "unknown"
| table _time, host, User, Image, CommandLine, ParentImage, ParentCommandLine,
        DecodeMethod, SuspiciousParent, HighPrivilege, WritesToSuspiciousPath, RiskScore
| sort - RiskScore, - _time

Detects deobfuscation and decoding activity using Sysmon Event ID 1 (Process Creation). Covers certutil -decode/-decodehex, PowerShell FromBase64String and compression stream decompression, cmd.exe copy /b binary reassembly, and expand.exe/extrac32.exe LOLBin abuse. Each event is enriched with a risk score based on suspicious parent processes (Office apps, script hosts, LOLBins), high-privilege execution context, and decoded output paths pointing to staging directories.

medium severity high confidence

Data Sources

Process: Process Creation Command: Command Execution Sysmon Event ID 1

Required Sourcetypes

XmlWinEventLog:Microsoft-Windows-Sysmon/Operational

False Positives

Software installation scripts using certutil to download and decode legitimate certificate files during provisioning workflows
IT automation tools (SCCM, Ansible, Chef) using PowerShell Base64 encoding to safely pass configuration parameters that contain special characters
Security scanning or vulnerability assessment tools that use certutil for certificate chain validation and CRL download
Legitimate software updaters that use expand.exe or extrac32.exe to unpack update packages delivered as CAB files
Developers testing encoding/decoding routines on workstations — typically identifiable by IDE parent processes and developer machine naming conventions

Elastic Security (EQL)

eql

sequence by host.name with maxspan=5m
  [process where event.type == "start" and
    (
      (process.name : "certutil.exe" and process.args : ("-decode", "-decodehex", "-urlcache", "-decodetohex", "-f")) or
      (process.name : ("powershell.exe", "pwsh.exe") and
        process.command_line : ("*FromBase64String*", "*[Convert]::*", "*[System.Convert]::*", "*IO.MemoryStream*", "*GZipStream*", "*DeflateStream*", "*IO.Compression*", "*::Decompress*")) or
      (process.name : "cmd.exe" and process.command_line : ("*copy /b*", "*copy /B*")) or
      (process.name : ("expand.exe", "extrac32.exe") and
        process.command_line : ("*.cab*", "*.zip*", "*.dat*", "*.bin*", "*.txt*", "*.jpg*", "*.png*", "*.tmp*"))
    )
  ] by process.pid

any where
  (
    (process.name : "certutil.exe" and process.args : ("-decode", "-decodehex", "-urlcache", "-decodetohex", "-f")) or
    (process.name : ("powershell.exe", "pwsh.exe") and
      process.command_line : ("*FromBase64String*", "*[Convert]::*", "*[System.Convert]::*", "*IO.MemoryStream*", "*GZipStream*", "*DeflateStream*", "*IO.Compression*", "*::Decompress*")) or
    (process.name : "cmd.exe" and process.command_line : ("*copy /b*", "*copy /B*")) or
    (process.name : ("expand.exe", "extrac32.exe"))
  ) and
  process.parent.name : ("wscript.exe", "cscript.exe", "mshta.exe", "winword.exe", "excel.exe", "outlook.exe", "rundll32.exe", "regsvr32.exe", "msbuild.exe", "installutil.exe", "regasm.exe")

Detects deobfuscation and decoding activity consistent with T1140 across four sub-branches: certutil decode flags, PowerShell Base64/GZip/Deflate decompression, cmd.exe binary fragment reassembly via copy /b, and LOLBin CAB extraction via expand.exe or extrac32.exe. The sequence query escalates fidelity by correlating decode activity with a suspicious parent process within a 5-minute window.

high severity high confidence

Data Sources

Elastic Endpoint Security Windows Security Events Sysmon via Elastic Agent

Required Tables

logs-endpoint.events.process-* winlogbeat-*

False Positives

IT administrators using certutil.exe to decode legitimate certificate files during PKI operations or troubleshooting.
Developers and build systems running PowerShell scripts that use Base64-encoded configuration blobs or compressed payloads embedded in CI/CD pipelines.
Software installers and package managers (Chocolatey, Scoop) that use expand.exe or extrac32.exe to extract bundled CAB archives during installation.

IBM QRadar (AQL)

sql

SELECT
  DATEFORMAT(starttime, 'YYYY-MM-dd HH:mm:ss') AS EventTime,
  sourceip AS SourceIP,
  username AS User,
  "HOSTNAME"(sourceip) AS Hostname,
  QIDNAME(qid) AS EventName,
  "Process Name" AS ProcessImage,
  "Command" AS CommandLine,
  "Parent Process" AS ParentImage,
  CASE
    WHEN LOWER("Process Name") LIKE '%certutil.exe%'
      AND (LOWER("Command") LIKE '%-decode%' OR LOWER("Command") LIKE '%-decodehex%' OR LOWER("Command") LIKE '%-urlcache%' OR LOWER("Command") LIKE '%-decodetohex%')
      THEN 'certutil-decode'
    WHEN (LOWER("Process Name") LIKE '%powershell.exe%' OR LOWER("Process Name") LIKE '%pwsh.exe%')
      AND ("Command" LIKE '%FromBase64String%' OR "Command" LIKE '%GZipStream%' OR "Command" LIKE '%DeflateStream%' OR "Command" LIKE '%IO.MemoryStream%' OR "Command" LIKE '%IO.Compression%')
      THEN 'powershell-base64-decompress'
    WHEN LOWER("Process Name") LIKE '%cmd.exe%'
      AND (LOWER("Command") LIKE '%copy /b%' OR LOWER("Command") LIKE '%copy /b %')
      THEN 'cmd-binary-reassembly'
    WHEN (LOWER("Process Name") LIKE '%expand.exe%' OR LOWER("Process Name") LIKE '%extrac32.exe%')
      THEN 'lolbin-cab-extract'
    ELSE 'unknown'
  END AS DecodeMethod,
  CASE
    WHEN LOWER("Parent Process") LIKE '%wscript.exe%'
      OR LOWER("Parent Process") LIKE '%cscript.exe%'
      OR LOWER("Parent Process") LIKE '%mshta.exe%'
      OR LOWER("Parent Process") LIKE '%winword.exe%'
      OR LOWER("Parent Process") LIKE '%excel.exe%'
      OR LOWER("Parent Process") LIKE '%outlook.exe%'
      OR LOWER("Parent Process") LIKE '%rundll32.exe%'
      OR LOWER("Parent Process") LIKE '%regsvr32.exe%'
      OR LOWER("Parent Process") LIKE '%msbuild.exe%'
      OR LOWER("Parent Process") LIKE '%installutil.exe%'
      OR LOWER("Parent Process") LIKE '%regasm.exe%'
      THEN 1
    ELSE 0
  END AS SuspiciousParent,
  CASE
    WHEN UPPER(username) LIKE '%SYSTEM%' OR UPPER(username) LIKE '%ADMINISTRATOR%'
      THEN 1
    ELSE 0
  END AS HighPrivilege
FROM events
WHERE
  LOGSOURCETYPENAME(devicetype) IN ('Microsoft Windows Security Event Log', 'Sysmon')
  AND starttime > NOW() - 86400000
  AND (
    (LOWER("Process Name") LIKE '%certutil.exe%'
      AND (LOWER("Command") LIKE '%-decode%' OR LOWER("Command") LIKE '%-decodehex%' OR LOWER("Command") LIKE '%-urlcache%'))
    OR
    ((LOWER("Process Name") LIKE '%powershell.exe%' OR LOWER("Process Name") LIKE '%pwsh.exe%')
      AND ("Command" LIKE '%FromBase64String%' OR "Command" LIKE '%GZipStream%' OR "Command" LIKE '%DeflateStream%' OR "Command" LIKE '%IO.MemoryStream%' OR "Command" LIKE '%IO.Compression%'))
    OR
    (LOWER("Process Name") LIKE '%cmd.exe%' AND LOWER("Command") LIKE '%copy /b%')
    OR
    (LOWER("Process Name") LIKE '%expand.exe%' OR LOWER("Process Name") LIKE '%extrac32.exe%')
  )
  AND CASE
    WHEN LOWER("Process Name") LIKE '%certutil.exe%'
      AND (LOWER("Command") LIKE '%-decode%' OR LOWER("Command") LIKE '%-decodehex%' OR LOWER("Command") LIKE '%-urlcache%' OR LOWER("Command") LIKE '%-decodetohex%')
      THEN 'certutil-decode'
    WHEN (LOWER("Process Name") LIKE '%powershell.exe%' OR LOWER("Process Name") LIKE '%pwsh.exe%')
      AND ("Command" LIKE '%FromBase64String%' OR "Command" LIKE '%GZipStream%' OR "Command" LIKE '%DeflateStream%' OR "Command" LIKE '%IO.MemoryStream%' OR "Command" LIKE '%IO.Compression%')
      THEN 'powershell-base64-decompress'
    WHEN LOWER("Process Name") LIKE '%cmd.exe%'
      AND (LOWER("Command") LIKE '%copy /b%' OR LOWER("Command") LIKE '%copy /b %')
      THEN 'cmd-binary-reassembly'
    WHEN (LOWER("Process Name") LIKE '%expand.exe%' OR LOWER("Process Name") LIKE '%extrac32.exe%')
      THEN 'lolbin-cab-extract'
    ELSE 'unknown'
  END <> 'unknown'
ORDER BY SuspiciousParent DESC, HighPrivilege DESC, starttime DESC

QRadar AQL query detecting T1140 deobfuscation activity across four sub-techniques: certutil decode flags, PowerShell Base64/GZip/Deflate operations, cmd.exe binary copy reassembly, and LOLBin CAB extraction. Events are tagged with a DecodeMethod label and risk-weighted by SuspiciousParent and HighPrivilege indicators, mirroring the KQL/SPL risk scoring logic.

high severity medium confidence

Data Sources

Microsoft Windows Security Event Log Sysmon via QRadar DSM

Required Tables

events

False Positives

Automated certificate management tools (ACME clients, AD CS scripts) that invoke certutil -decode or -urlcache to process legitimate DER/PEM certificate conversions.
Enterprise software deployment systems (SCCM, Intune) running PowerShell with Base64-encoded configuration payloads for device provisioning.
Windows Update and application installers that use expand.exe or extrac32.exe to unpack compressed CAB bundles during patching workflows.

Sumo Logic CSE

sql

_sourceCategory=*windows* OR _sourceCategory=*sysmon* OR _sourceCategory=*winevent*
| where EventID = "1" OR EventID = "4688"
| json auto
| parse field=CommandLine "*" as RawCommand nodrop
| where (
    (toLower(Image) matches "*\\certutil.exe"
      AND (toLower(CommandLine) matches "*-decode*" OR toLower(CommandLine) matches "*-decodehex*" OR toLower(CommandLine) matches "*-urlcache*" OR toLower(CommandLine) matches "*-decodetohex*"))
  OR
    ((toLower(Image) matches "*\\powershell.exe" OR toLower(Image) matches "*\\pwsh.exe")
      AND (CommandLine matches "*FromBase64String*" OR CommandLine matches "*GZipStream*" OR CommandLine matches "*DeflateStream*" OR CommandLine matches "*IO.MemoryStream*" OR CommandLine matches "*IO.Compression*" OR CommandLine matches "*::Decompress*"))
  OR
    (toLower(Image) matches "*\\cmd.exe"
      AND (toLower(CommandLine) matches "*copy /b*" OR toLower(CommandLine) matches "*copy /b *"))
  OR
    (toLower(Image) matches "*\\expand.exe" OR toLower(Image) matches "*\\extrac32.exe")
  )
| eval DecodeMethod = if(toLower(Image) matches "*certutil.exe*" AND (toLower(CommandLine) matches "*-decode*" OR toLower(CommandLine) matches "*-decodehex*" OR toLower(CommandLine) matches "*-urlcache*"), "certutil-decode",
    if((toLower(Image) matches "*powershell.exe*" OR toLower(Image) matches "*pwsh.exe*") AND CommandLine matches "*FromBase64String*", "ps-base64-decode",
    if((toLower(Image) matches "*powershell.exe*" OR toLower(Image) matches "*pwsh.exe*") AND (CommandLine matches "*GZipStream*" OR CommandLine matches "*DeflateStream*" OR CommandLine matches "*::Decompress*"), "ps-decompress",
    if(toLower(Image) matches "*cmd.exe*" AND toLower(CommandLine) matches "*copy /b*", "cmd-binary-reassembly",
    if(toLower(Image) matches "*expand.exe*" OR toLower(Image) matches "*extrac32.exe*", "lolbin-cab-extract",
    "unknown")))))
| eval SuspiciousParent = if(toLower(ParentImage) matches "*wscript.exe*" OR toLower(ParentImage) matches "*cscript.exe*" OR toLower(ParentImage) matches "*mshta.exe*" OR toLower(ParentImage) matches "*winword.exe*" OR toLower(ParentImage) matches "*excel.exe*" OR toLower(ParentImage) matches "*outlook.exe*" OR toLower(ParentImage) matches "*rundll32.exe*" OR toLower(ParentImage) matches "*regsvr32.exe*" OR toLower(ParentImage) matches "*msbuild.exe*" OR toLower(ParentImage) matches "*installutil.exe*" OR toLower(ParentImage) matches "*regasm.exe*", 1, 0)
| eval HighPrivilege = if(toUpperCase(User) matches "*SYSTEM*" OR toUpperCase(User) matches "*ADMINISTRATOR*", 1, 0)
| eval WritesToSuspiciousPath = if(toLower(CommandLine) matches "*(temp|tmp|appdata|public|programdata|recycle)*", 1, 0)
| eval RiskScore = SuspiciousParent * 2 + HighPrivilege + WritesToSuspiciousPath
| where DecodeMethod != "unknown"
| fields _messageTime, Computer, User, Image, CommandLine, ParentImage, ParentCommandLine, DecodeMethod, SuspiciousParent, HighPrivilege, WritesToSuspiciousPath, RiskScore
| sort by RiskScore desc, _messageTime desc

Sumo Logic query targeting T1140 deobfuscation activity from Windows Sysmon Event ID 1 or Security Event ID 4688 process creation logs. Covers certutil decode flags, PowerShell Base64/GZip/Deflate operations, cmd.exe binary reassembly, and LOLBin CAB extraction. RiskScore field weights events by suspicious parent process, privilege level, and suspicious output path targeting.

high severity medium confidence

Data Sources

Sysmon (Event ID 1) Windows Security (Event ID 4688) Windows Event Log

Required Tables

_sourceCategory=*windows* _sourceCategory=*sysmon*

False Positives

Security tools and EDR agents that decode telemetry or configuration blobs using PowerShell Base64 operations as part of their normal operation.
DevOps pipelines executing PowerShell scripts with compressed or Base64-encoded payloads for configuration management (Ansible, Chef, Puppet Windows agents).
Helpdesk and IT automation scripts using certutil for routine certificate export, import, or CRL retrieval that include -urlcache flags.

Google Chronicle / SecOps

yaral

rule t1140_deobfuscate_decode_files {
  meta:
    author = "Argus Detection Engineering"
    description = "Detects T1140 deobfuscation and decoding activity: certutil decode flags, PowerShell Base64/GZip/Deflate operations, cmd.exe binary copy reassembly, and LOLBin CAB extraction via expand.exe or extrac32.exe."
    mitre_attack_tactic = "Defense Evasion"
    mitre_attack_technique = "T1140"
    mitre_attack_url = "https://attack.mitre.org/techniques/T1140/"
    severity = "HIGH"
    priority = "HIGH"

  events:
    $e.metadata.event_type = "PROCESS_LAUNCH"
    $e.principal.hostname = $hostname
    $e.target.process.command_line = $cmdline
    $e.target.process.file.full_path = $image

    (
      // Branch 1: certutil decode
      (
        re.regex($image, `(?i)certutil\.exe$`) and
        (
          re.regex($cmdline, `(?i)-decode`) or
          re.regex($cmdline, `(?i)-decodehex`) or
          re.regex($cmdline, `(?i)-urlcache`) or
          re.regex($cmdline, `(?i)-decodetohex`) or
          re.regex($cmdline, `(?i)-f\s+-split`)
        )
      ) or
      // Branch 2: PowerShell Base64 / GZip / Deflate
      (
        re.regex($image, `(?i)(powershell|pwsh)\.exe$`) and
        (
          strings.contains($cmdline, "FromBase64String") or
          strings.contains($cmdline, "[Convert]::") or
          strings.contains($cmdline, "[System.Convert]::") or
          strings.contains($cmdline, "IO.MemoryStream") or
          strings.contains($cmdline, "GZipStream") or
          strings.contains($cmdline, "DeflateStream") or
          strings.contains($cmdline, "IO.Compression") or
          strings.contains($cmdline, "::Decompress")
        )
      ) or
      // Branch 3: cmd.exe binary fragment reassembly
      (
        re.regex($image, `(?i)cmd\.exe$`) and
        re.regex($cmdline, `(?i)copy\s+/[bB]`)
      ) or
      // Branch 4: expand.exe / extrac32.exe LOLBin CAB extraction
      (
        re.regex($image, `(?i)(expand|extrac32)\.exe$`) and
        re.regex($cmdline, `(?i)\.(cab|zip|dat|bin|txt|jpg|png|tmp)`)
      )
    )

  match:
    $hostname over 5m

  outcome:
    $risk_score = max(
      if(re.regex($e.principal.process.file.full_path, `(?i)(wscript|cscript|mshta|winword|excel|outlook|rundll32|regsvr32|msbuild|installutil|regasm)\.exe`), 2, 0) +
      if(re.regex($e.principal.user.userid, `(?i)(system|administrator)`), 1, 0)
    )
    $decode_method = if(re.regex($image, `(?i)certutil\.exe`), "certutil-decode",
      if(re.regex($image, `(?i)(powershell|pwsh)\.exe`) and strings.contains($cmdline, "FromBase64String"), "ps-base64-decode",
      if(re.regex($image, `(?i)(powershell|pwsh)\.exe`) and (strings.contains($cmdline, "GZipStream") or strings.contains($cmdline, "DeflateStream")), "ps-decompress",
      if(re.regex($image, `(?i)cmd\.exe`), "cmd-binary-reassembly",
      if(re.regex($image, `(?i)(expand|extrac32)\.exe`), "lolbin-cab-extract",
      "unknown")))))
    $parent_image = $e.principal.process.file.full_path
    $user = $e.principal.user.userid

  condition:
    $e
}

Chronicle YARA-L 2.0 rule detecting T1140 deobfuscation activity across four behavioral branches: certutil with decode flags, PowerShell Base64/GZip/Deflate operations, cmd.exe binary reassembly via copy /b, and LOLBin CAB extraction. Risk scoring is computed in the outcome block based on suspicious parent process lineage and high-privilege execution context. The 5-minute match window correlates repeated decode activity per host.

high severity high confidence

Data Sources

Google Chronicle UDM Windows Event Log via Chronicle forwarder Sysmon via Chronicle

Required Tables

UDM PROCESS_LAUNCH events

False Positives

Enterprise PKI management scripts and tools (AD CS, Let's Encrypt ACME clients) that call certutil -decode or -urlcache to process certificate chains and CRL distribution points.
Security operations tooling (SOAR playbooks, EDR response scripts) that use PowerShell Base64 encoding to pass configuration or evidence collection payloads over APIs.
Windows software distribution tools (SCCM deployment packages, Chocolatey) that invoke expand.exe to extract bundled CAB or ZIP archives during installation.

CrowdStrike LogScale (CQL)

cql

#event_simpleName=ProcessRollup2
| ImageFileName = /(?i)(certutil|powershell|pwsh|cmd|expand|extrac32)\.exe$/
| CommandLine = /.+/
// Classify decode method
| DecodeMethod := case {
    ImageFileName = /(?i)certutil\.exe/ AND CommandLine = /(?i)(-decode|-decodehex|-urlcache|-decodetohex|-f\s+-split)/ : "certutil-decode" ;
    ImageFileName = /(?i)(powershell|pwsh)\.exe/ AND CommandLine = /FromBase64String|\[Convert\]::|\[System\.Convert\]::|IO\.MemoryStream/ : "ps-base64-decode" ;
    ImageFileName = /(?i)(powershell|pwsh)\.exe/ AND CommandLine = /GZipStream|DeflateStream|IO\.Compression|::Decompress/ : "ps-decompress" ;
    ImageFileName = /(?i)cmd\.exe/ AND CommandLine = /(?i)copy\s+\/[bB]/ : "cmd-binary-reassembly" ;
    ImageFileName = /(?i)(expand|extrac32)\.exe/ AND CommandLine = /(?i)\.(cab|zip|dat|bin|txt|jpg|png|tmp)/ : "lolbin-cab-extract" ;
    * : "unknown"
  }
| DecodeMethod != "unknown"
// Flag suspicious parent processes
| SuspiciousParent := if(
    ParentBaseFileName = /(?i)(wscript|cscript|mshta|winword|excel|outlook|rundll32|regsvr32|msbuild|installutil|regasm)\.exe/,
    1, 0
  )
// Flag high privilege execution
| HighPrivilege := if(
    UserName = /(?i)(system|administrator)/,
    1, 0
  )
// Flag writes to suspicious staging paths
| SuspiciousPath := if(
    CommandLine = /(?i)(temp|tmp|appdata|public|programdata|recycle)/,
    1, 0
  )
// Compute composite risk score
| RiskScore := SuspiciousParent * 2 + HighPrivilege + SuspiciousPath
| groupBy(
    [ComputerName, UserName, ImageFileName, CommandLine, ParentBaseFileName, ParentCommandLine, DecodeMethod, SuspiciousParent, HighPrivilege, SuspiciousPath, RiskScore],
    function=max(RiskScore, as=MaxRisk)
  )
| sort(MaxRisk, order=desc)

CrowdStrike LogScale (Falcon) CQL query detecting T1140 deobfuscation activity using ProcessRollup2 events. Covers certutil decode flags, PowerShell Base64/GZip/Deflate operations, cmd.exe binary copy reassembly, and LOLBin CAB extraction via expand.exe or extrac32.exe. DecodeMethod classifies the technique; composite RiskScore weights results by suspicious parent process lineage, privilege level, and suspicious output path targeting to prioritize analyst triage.

high severity high confidence

Data Sources

CrowdStrike Falcon EDR Falcon ProcessRollup2 events

Required Tables

ProcessRollup2

False Positives

Falcon sensor exclusions or IT automation accounts running certutil in scheduled tasks for routine certificate lifecycle operations (renewal, CRL updates, OCSP stapling).
PowerShell Desired State Configuration (DSC) and endpoint management agents that encode configuration MOF documents or remediation scripts as Base64 to transport them securely.
Third-party application installers bundled by software vendors that use expand.exe or extrac32.exe to self-extract CAB-formatted payload archives as part of their setup routines.

Sigma rule & cross-platform mapping

The detection logic for Deobfuscate/Decode Files or Information (T1140) above is provided in a vendor-neutral form so you can deploy it on any SIEM. The same logic is shipped here as native KQL (Microsoft Sentinel / Defender), SPL (Splunk), Elastic (Elastic Security (EQL)), QRadar (IBM QRadar (AQL)), Sumo (Sumo Logic CSE), YARA-L (Google Chronicle / SecOps), LogScale (CrowdStrike LogScale (CQL)) queries. In Sigma terms, this detection targets the following logsource:

logsource:
  category: process_creation
  product: windows

Browse the community-maintained Sigma rules for this technique:

SigmaHQ rules for T1140 Sigma rules on detection.fyi

Platform-specific guides for T1140

Detect in Microsoft Sentinel (KQL) Detect in Splunk (SPL) Detect in Elastic Security (Elastic) Detect in IBM QRadar (QRadar) Detect in Sumo Logic CSE (Sumo) Detect in Google Chronicle (YARA-L) Detect in CrowdStrike LogScale (LogScale)

Last updated: 2026-04-18 Research depth: deep

References (9)

Testing Methodology

Validate this detection against 5 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.

Test 1Certutil Base64 Decode — Payload Disguised as Certificate File
Expected signal: Sysmon Event ID 1: Process Create with Image=certutil.exe, CommandLine containing '-decode C:\ProgramData\payload.txt C:\ProgramData\decoded_output.txt'. Sysmon Event ID 11: File Create for decoded_output.txt. Security Event ID 4688 (if process creation auditing with command line enabled): same certutil invocation captured in Windows Security log.
Test 2PowerShell In-Memory Base64 Decode and Decompress Chain
Expected signal: Sysmon Event ID 1: Process Create with Image=powershell.exe, CommandLine containing 'FromBase64String', 'IO.MemoryStream', and 'GZipStream'. PowerShell ScriptBlock Logging (Event ID 4104): full script block captured in Microsoft-Windows-PowerShell/Operational log, showing the decompressed payload content. No file creation events — this is an entirely in-memory operation.
Test 3cmd.exe Binary Fragment Reassembly with copy /b
Expected signal: Sysmon Event ID 1: Process Create with Image=cmd.exe, CommandLine containing 'copy /b' and the fragment paths. Sysmon Event ID 11: File Create events for frag1.dat, frag2.dat, and reassembled.bin. Security Event ID 4688 with command line auditing will capture the copy /b invocation. The output file reassembled.bin in C:\Users\Public is a staging-directory indicator.
Test 4Certutil URL Cache Download and Decode (Simulated Offline)
Expected signal: Sysmon Event ID 1: Process Create with Image=certutil.exe, CommandLine containing '-urlcache -split -f http://127.0.0.1:8080' and 'C:\Windows\Temp\payload.b64'. Sysmon Event ID 3: Network Connection attempt to 127.0.0.1:8080 (connection will be refused). Windows Prefetch: CERTUTIL.EXE-*.pf updated with execution timestamp. The URL cache is also updated in %APPDATA%\Microsoft\Windows\IECompatCache regardless of download success.
Test 5Linux Base64 Decode of Payload to Staging Directory
Expected signal: Linux auditd EXECVE records for bash/sh executing 'base64 -d' and 'chmod +x'. Syslog entries capturing the command execution. If Sysmon for Linux is deployed: process creation event with CommandLine containing 'base64 -d' and output redirect to /tmp. File creation event for /tmp/.hidden_payload. The chmod +x on a newly created file in /tmp is an additional behavioral indicator captured as a separate process creation event.

Response Playbook

Triage

Identify the decode method used — certutil -decode targeting a file with a non-certificate extension (.txt, .jpg, .dat) is immediately suspicious; legitimate certutil use targets .cer, .crt, .p7b, or .pfx files
Examine the input and output file paths — malicious deobfuscation typically reads from temp/public staging directories (C:\ProgramData, C:\Users\Public, %TEMP%) and writes executables or scripts to the same locations
Determine the parent process — Office application, wscript.exe, mshta.exe, or a browser spawning certutil or PowerShell is a critical red flag indicating phishing or drive-by delivery context
For PowerShell FromBase64String events, decode the Base64 value manually: [System.Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('<string>')) — or use CyberChef for multi-layer decode chains
Check for file creation events (Sysmon Event ID 11) immediately following the decode event — look for .exe, .dll, .ps1, .vbs, .bat, or .js files written to staging directories
Review subsequent process creation (Sysmon Event ID 1) after the decode — did the output file get executed? Execution of a freshly decoded file is a strong indicator of compromise
Correlate with network events — did the host establish outbound connections shortly after the decode activity? Certutil is also commonly used with -urlcache to download encoded payloads before decoding

Containment

If a malicious decoded payload has been written to disk and not yet executed: quarantine the file using EDR isolation capabilities and hash the file for threat intelligence lookup before deletion
If the decoded payload has already been executed: immediately isolate the endpoint from the network using EDR network isolation to prevent C2 communication or lateral movement
If the decode was triggered by a user opening a phishing document: disable the user account, revoke active authentication tokens, and identify any other recipients of the same phishing campaign
Block the certutil.exe -decode and -urlcache command patterns via Windows Defender Attack Surface Reduction (ASR) rule: Block abuse of exploited vulnerable signed drivers (or configure AppLocker/WDAC to restrict certutil arguments)
If expand.exe or extrac32.exe LOLBin abuse is confirmed: add a WDAC policy to restrict these binaries or restrict their execution via Software Restriction Policies in the affected OU
Preserve the encoded/obfuscated input file and decoded output file as forensic evidence before any remediation actions

Evidence Collection

Sysmon Event ID 1 (Process Create) for the decode command — captures full command line including input/output file paths and parent process chain
Sysmon Event ID 11 (File Create) for any files written by the decode process — captures full path, file hash (MD5/SHA256), and creation timestamp
Sysmon Event ID 23/26 (File Delete/Shred) — if the encoded source file was deleted after decoding, these events capture the deletion
PowerShell ScriptBlock Logging (Event ID 4104) — for PowerShell decode operations, captures the full deobfuscated script content including any FromBase64String decoded values
Windows Prefetch — C:\Windows\Prefetch\CERTUTIL.EXE-*.pf contains execution count and loaded DLLs to establish decode timeline
Zone.Identifier alternate data stream on the encoded input file — if $R attribute exists, it indicates the file was downloaded from the internet (MOTW) and captures the source URL
File system artifacts — the decoded output file itself (collect before remediation), the encoded source file, and any intermediate staging files
AmCache and ShimCache entries for any executables created by the decode process — provides persistence evidence even if files were subsequently deleted
Security Event ID 4663 (Object Access) — if file auditing is enabled on staging directories, captures read access to the encoded file

Escalation Criteria

! Certutil decode output is an executable (PE header: MZ/4D5A) or script (.ps1, .vbs, .bat, .js) — indicates a dropper staging a second-stage payload
! The decode activity is followed within minutes by execution of the decoded file, network connections to external IPs, or credential access activity — indicates active exploitation in progress
! Parent process is a Microsoft Office application, browser, or script host — indicates phishing/drive-by delivery was successful
! Decode activity observed on multiple endpoints in a short time window — indicates automated propagation or coordinated campaign
! Decoded content matches known malware signatures (check file hash against VirusTotal/threat intel before escalating further)
! Decode activity is performed by SYSTEM or a high-privilege domain account with no corresponding change management ticket
! Evidence of multi-stage decode chains (output of one decode becomes input to another) — indicates sophisticated obfuscation designed to defeat automated analysis

Investigation Guide

Forensic Artifacts

> File System: The encoded source file (e.g., a .txt or .dat file with Base64 content or binary fragments in staging directories like C:\ProgramData, C:\Users\Public, %TEMP%)
> File System: The decoded output file (PE, DLL, or script) — collect file hash and submit to threat intelligence before deletion
> Alternate Data Stream: Zone.Identifier on the source encoded file — contains HostUrl and ReferrerUrl if downloaded from the internet, establishing delivery vector
> Windows Prefetch: C:\Windows\Prefetch\CERTUTIL.EXE-*.pf — execution count, timestamps, and referenced file paths for certutil decode operations
> Registry: HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs — recent file access may include paths to encoded payload files
> Event Log: Microsoft-Windows-PowerShell/Operational (Event ID 4104) — decoded script content for PowerShell-based decode chains
> Event Log: Microsoft-Windows-Sysmon/Operational (Event IDs 1, 11, 23) — process creation, file creation, and file deletion for the decode workflow
> AmCache: C:\Windows\AppCompat\Programs\Amcache.hve — execution record for certutil.exe and any decoded executables, including SHA1 hash
> ShimCache / AppCompatCache: Registry — SYSTEM\CurrentControlSet\Control\Session Manager\AppCompatCache — execution history for the decode tools
> LNK Files: C:\Users\<user>\AppData\Roaming\Microsoft\Windows\Recent — may reference recently opened encoded payload files if user-initiated

Tuning Guidance

The highest-fidelity signal is certutil decode targeting non-certificate file types or writing executable output — this should almost never be a false positive in production environments. Tune by creating an allowlist of known-good certutil invocations from software installation processes (identify by parent process = msiexec.exe, setup.exe, or specific vendor installers). For PowerShell FromBase64String alerts, filter out events where the parent is a known IT automation tool (ccmexec.exe for SCCM, dsmagent.exe for TSM backup, or specific monitoring agent process names). The copy /b reassembly detection has higher false positive potential from legitimate split-file operations in software distribution — tune by requiring the output extension to be executable (.exe, .dll, .ps1) or by requiring the parent process to be something other than xcopy.exe, robocopy.exe, or a known backup tool. Consider creating a dedicated watchlist of staging directories (Temp, AppData\Local\Temp, ProgramData, Users\Public) and elevating severity for any decode activity writing to those paths. For high-volume environments, prioritize events with RiskScore >= 2 (suspicious parent OR high privilege) and use the hunting queries to catch stealthier patterns like multi-stage decode chains.

Hunting Queries

Hunt for certutil decode operations where the input file does not have a legitimate certificate extension or the output file is an executable/script type. Legitimate certutil usage decodes .cer, .crt, .p7b files — decoding .txt, .dat, .jpg, or similar disguised payloads is a strong indicator of T1140 abuse.

Hunting — KQL

kql

// Hunt for certutil decoding files with non-certificate extensions — a strong indicator of payload staging
DeviceProcessEvents
| where Timestamp > ago(7d)
| where FileName =~ "certutil.exe"
| where ProcessCommandLine has_any ("-decode", "-decodehex")
| extend OutputFile = extract(@"-decode[hex]?\s+\S+\s+(\S+)", 1, ProcessCommandLine)
| extend InputFile = extract(@"-decode[hex]?\s+(\S+)", 1, ProcessCommandLine)
| extend OutputExtension = extract(@"\.(\w+)$", 1, tolower(OutputFile))
| extend InputExtension = extract(@"\.(\w+)$", 1, tolower(InputFile))
| where InputExtension !in ("cer", "crt", "p7b", "pfx", "pem", "der")
   or OutputExtension in ("exe", "dll", "ps1", "vbs", "bat", "js", "hta", "cmd", "scr", "com")
| project Timestamp, DeviceName, AccountName, ProcessCommandLine,
         InputFile, InputExtension, OutputFile, OutputExtension,
         InitiatingProcessFileName
| sort by Timestamp desc

Hunting — SPL

spl

index=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1
  Image="*\\certutil.exe" (CommandLine="*-decode*" OR CommandLine="*-decodehex*")
| rex field=CommandLine "-decode[hex]?\s+(?<InputFile>\S+)\s+(?<OutputFile>\S+)"
| eval InputExt=lower(mvindex(split(InputFile, "."), -1))
| eval OutputExt=lower(mvindex(split(OutputFile, "."), -1))
| where NOT (InputExt IN ("cer", "crt", "p7b", "pfx", "pem", "der"))
   OR OutputExt IN ("exe", "dll", "ps1", "vbs", "bat", "js", "hta", "cmd", "scr")
| table _time, host, User, CommandLine, InputFile, InputExt, OutputFile, OutputExt, ParentImage
| sort - _time

Hunt for multi-stage decode chains where certutil and PowerShell decode operations occur on the same host within 5 minutes of each other. This pattern — certutil downloads/decodes an initial payload, then PowerShell further decompresses/executes a second stage — is characteristic of sophisticated malware loaders such as those used by APT groups and ransomware operators.

Hunting — KQL

kql

// Hunt for multi-stage decode chains: PowerShell decoding within 5 minutes of certutil on same device
let CertutilDecodes = DeviceProcessEvents
| where Timestamp > ago(7d)
| where FileName =~ "certutil.exe"
| where ProcessCommandLine has_any ("-decode", "-decodehex", "-urlcache")
| project CertutilTime=Timestamp, DeviceName, AccountName, CertutilCmd=ProcessCommandLine;
let PSDecodes = DeviceProcessEvents
| where Timestamp > ago(7d)
| where FileName in~ ("powershell.exe", "pwsh.exe")
| where ProcessCommandLine has_any ("FromBase64String", "GZipStream", "DeflateStream", "IO.Compression")
| project PSTime=Timestamp, DeviceName, PSCmd=ProcessCommandLine;
CertutilDecodes
| join kind=inner PSDecodes on DeviceName
| where abs(datetime_diff('minute', CertutilTime, PSTime)) <= 5
| project CertutilTime, PSTime, DeviceName, AccountName, CertutilCmd, PSCmd
| sort by CertutilTime desc

Hunting — SPL

spl

index=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1
  Image="*\\certutil.exe" (CommandLine="*-decode*" OR CommandLine="*-urlcache*")
| eval decode_time=_time
| eval decode_host=host
| table decode_time, decode_host, CommandLine
| join type=inner decode_host
    [search index=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1
     (Image="*\\powershell.exe" OR Image="*\\pwsh.exe")
     (CommandLine="*FromBase64String*" OR CommandLine="*GZipStream*" OR CommandLine="*IO.Compression*")
    | eval ps_time=_time
    | eval decode_host=host
    | table ps_time, decode_host, CommandLine]
| eval time_diff=abs(ps_time - decode_time)
| where time_diff <= 300
| table decode_time, ps_time, time_diff, decode_host, CommandLine
| sort - decode_time

Hunt for decode activity followed within 10 minutes by execution of a file from a staging directory (Temp, AppData, ProgramData, Public). This execution-after-decode pattern is the clearest behavioral indicator of T1140 being used as part of an active exploitation chain, distinguishing malicious deobfuscation from administrative or development activity.

Hunting — KQL

kql

// Hunt for decode activity followed by execution of newly created files — indicates successful payload delivery
let DecodeEvents = DeviceProcessEvents
| where Timestamp > ago(7d)
| where FileName in~ ("certutil.exe", "expand.exe", "extrac32.exe")
    or (FileName in~ ("powershell.exe", "pwsh.exe") and ProcessCommandLine has_any ("FromBase64String", "GZipStream", "DeflateStream"))
    or (FileName =~ "cmd.exe" and ProcessCommandLine has "copy /b")
| project DecodeTime=Timestamp, DeviceName, AccountName, DecodeTool=FileName;
let FileExecution = DeviceProcessEvents
| where Timestamp > ago(7d)
| where FolderPath has_any (@"\Temp\\", @"\AppData\\", @"\ProgramData\\", @"\Users\Public\")
| project ExecTime=Timestamp, DeviceName, ExecFile=FileName, ExecPath=FolderPath, ExecCmd=ProcessCommandLine;
DecodeEvents
| join kind=inner FileExecution on DeviceName
| where ExecTime > DecodeTime and datetime_diff('minute', ExecTime, DecodeTime) <= 10
| project DecodeTime, ExecTime, DeviceName, AccountName, DecodeTool, ExecFile, ExecPath, ExecCmd
| sort by DecodeTime desc

Hunting — SPL

spl

index=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1
(
  Image="*\\certutil.exe" (CommandLine="*-decode*" OR CommandLine="*-decodehex*")
  OR Image="*\\expand.exe"
  OR (Image IN ("*\\powershell.exe", "*\\pwsh.exe") AND (CommandLine="*FromBase64String*" OR CommandLine="*GZipStream*"))
  OR (Image="*\\cmd.exe" AND CommandLine="*copy /b*")
)
| eval decode_time=_time, decode_host=host, decode_tool=Image
| appendcols
    [search index=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1
     (CurrentDirectory="*\\Temp*" OR CurrentDirectory="*\\AppData*" OR CurrentDirectory="*\\ProgramData*" OR CurrentDirectory="*Public*")
    | eval exec_time=_time, exec_host=host, exec_file=Image
    | table exec_time, exec_host, exec_file, CommandLine]
| eval time_diff=exec_time - decode_time
| where time_diff > 0 AND time_diff <= 600 AND decode_host=exec_host
| table decode_time, exec_time, decode_host, decode_tool, exec_file, CommandLine
| sort - decode_time

Atomic Red Team Tests

Test 1 Certutil Base64 Decode — Payload Disguised as Certificate File

windows

Uses certutil.exe to decode a Base64-encoded payload disguised as a certificate file. This is the canonical T1140 technique documented in the wild — attackers place Base64-encoded executables or scripts in .cer or .txt files and use certutil -decode to recover the original binary. This test encodes a benign text file and immediately decodes it to validate detection without executing a payload.

Command

powershell

echo VGhpcyBpcyBhIGRmMDB0ZWNoIGF0b21pYyB0ZXN0Lg== > C:\ProgramData\payload.txt && certutil.exe -decode C:\ProgramData\payload.txt C:\ProgramData\decoded_output.txt

Cleanup

powershell

del C:\ProgramData\payload.txt 2>nul & del C:\ProgramData\decoded_output.txt 2>nul

Expected Telemetry

Sysmon Event ID 1: Process Create with Image=certutil.exe, CommandLine containing '-decode C:\ProgramData\payload.txt C:\ProgramData\decoded_output.txt'. Sysmon Event ID 11: File Create for decoded_output.txt. Security Event ID 4688 (if process creation auditing with command line enabled): same certutil invocation captured in Windows Security log.

Expected Detection

KQL alert fires via CertutilDecodePatterns match on '-decode'. DecodeMethod=certutil. SPL alert fires with DecodeMethod='certutil-decode'. Input file extension (.txt) does not match legitimate certificate extensions — hunting query flags this as anomalous.

Test 2 PowerShell In-Memory Base64 Decode and Decompress Chain

windows

Simulates a two-stage in-memory decode chain commonly used by PowerShell loaders and stagers: first decoding Base64, then decompressing a GZip-compressed payload. This pattern is used by frameworks like Cobalt Strike, Empire, and Metasploit to stage shellcode or additional PowerShell scripts entirely in memory without writing to disk. The payload in this test decompresses to a benign string.

Command

powershell

powershell.exe -NoProfile -Command "$b64 = 'H4sIAAAAAAAA/0rNS8svyklRslIqS8wpTssvyklRAgQAAP//JqhWFhAAAAA='; $bytes = [Convert]::FromBase64String($b64); $ms = New-Object IO.MemoryStream(,$bytes); $gs = New-Object IO.Compression.GZipStream($ms, [IO.Compression.CompressionMode]::Decompress); $sr = New-Object IO.StreamReader($gs); $result = $sr.ReadToEnd(); Write-Output $result"

Expected Telemetry

Sysmon Event ID 1: Process Create with Image=powershell.exe, CommandLine containing 'FromBase64String', 'IO.MemoryStream', and 'GZipStream'. PowerShell ScriptBlock Logging (Event ID 4104): full script block captured in Microsoft-Windows-PowerShell/Operational log, showing the decompressed payload content. No file creation events — this is an entirely in-memory operation.

Expected Detection

KQL alert fires via PSDecodeEvents branch on 'FromBase64String' and 'GZipStream'. DecodeMethod='powershell-base64'. Indicator='GZip-Decompress'. SPL alert fires with DecodeMethod='ps-decompress', RiskScore=1 baseline (elevated if run from suspicious parent). Multi-stage hunting query may also trigger if certutil was invoked previously.

Test 3 cmd.exe Binary Fragment Reassembly with copy /b

windows

Demonstrates the Windows cmd.exe copy /b technique used by threat actors (notably documented by Carbon Black in 2016) to reassemble a malicious binary split across multiple innocuous-looking files. Attackers split executables into chunks disguised as unrelated file types and use copy /b to concatenate them. This test creates two benign binary fragments and reassembles them without executing the result.

Command

powershell

echo df00tech_fragment_1 > C:\Users\Public\frag1.dat && echo df00tech_fragment_2 > C:\Users\Public\frag2.dat && cmd.exe /c copy /b C:\Users\Public\frag1.dat+C:\Users\Public\frag2.dat C:\Users\Public\reassembled.bin

Cleanup

powershell

del C:\Users\Public\frag1.dat 2>nul & del C:\Users\Public\frag2.dat 2>nul & del C:\Users\Public\reassembled.bin 2>nul

Expected Telemetry

Sysmon Event ID 1: Process Create with Image=cmd.exe, CommandLine containing 'copy /b' and the fragment paths. Sysmon Event ID 11: File Create events for frag1.dat, frag2.dat, and reassembled.bin. Security Event ID 4688 with command line auditing will capture the copy /b invocation. The output file reassembled.bin in C:\Users\Public is a staging-directory indicator.

Expected Detection

KQL alert fires via CmdReassemblyEvents branch on 'copy /b' pattern. DecodeMethod='cmd-binary-reassembly'. Indicator='binary-fragment-reassembly'. WritesToSuspiciousPath=1 (Public directory). SPL alert fires with DecodeMethod='cmd-binary-reassembly' and elevated RiskScore due to staging directory. Hunting query for execution-after-decode will alert if reassembled.bin is subsequently executed.

Test 4 Certutil URL Cache Download and Decode (Simulated Offline)

windows

Simulates the certutil -urlcache -split -f technique used by KONNI and other malware to download Base64-encoded payloads from a URL and decode them locally. Certutil's URL cache feature is widely abused as a download LOLBin. This test uses localhost as the target URL to keep it safe — the download will fail but the process creation telemetry will still fire for detection validation. A real attacker would point this at a C2 or staging server.

Command

powershell

certutil.exe -urlcache -split -f http://127.0.0.1:8080/encoded_payload.b64 C:\Windows\Temp\payload.b64

Cleanup

powershell

del C:\Windows\Temp\payload.b64 2>nul & certutil.exe -urlcache -f http://127.0.0.1:8080/encoded_payload.b64 delete 2>nul

Expected Telemetry

Sysmon Event ID 1: Process Create with Image=certutil.exe, CommandLine containing '-urlcache -split -f http://127.0.0.1:8080' and 'C:\Windows\Temp\payload.b64'. Sysmon Event ID 3: Network Connection attempt to 127.0.0.1:8080 (connection will be refused). Windows Prefetch: CERTUTIL.EXE-*.pf updated with execution timestamp. The URL cache is also updated in %APPDATA%\Microsoft\Windows\IECompatCache regardless of download success.

Expected Detection

KQL alert fires via CertutilDecodePatterns match on '-urlcache'. DecodeMethod='certutil'. SPL alert fires with DecodeMethod='certutil-decode'. Output path C:\Windows\Temp is a staging directory — RiskScore elevated. Certutil URL cache hunting query in hunting queries section will flag this pattern.

Test 5 Linux Base64 Decode of Payload to Staging Directory

linux

Simulates Linux-based T1140 activity where adversaries use the native base64 utility (or openssl enc) to decode a Base64-encoded payload in a world-writable staging directory. This pattern is common in Linux-targeting malware campaigns and post-exploitation frameworks targeting cloud workloads, containers, and ESXi hosts. The decoded content in this test is benign.

Command

bash

echo 'ZGYwMHRlY2ggYXRvbWljIHRlc3QgZm9yIFQxMTQwIG9uIExpbnV4Cg==' | base64 -d > /tmp/.hidden_payload && chmod +x /tmp/.hidden_payload

Cleanup

bash

rm -f /tmp/.hidden_payload

Expected Telemetry

Linux auditd EXECVE records for bash/sh executing 'base64 -d' and 'chmod +x'. Syslog entries capturing the command execution. If Sysmon for Linux is deployed: process creation event with CommandLine containing 'base64 -d' and output redirect to /tmp. File creation event for /tmp/.hidden_payload. The chmod +x on a newly created file in /tmp is an additional behavioral indicator captured as a separate process creation event.

Expected Detection

Linux-targeted SPL query using linux_secure or syslog sourcetype detects base64 decode to /tmp with immediate chmod +x. The combination of decode + execute permission grant is a high-confidence indicator. SIEM correlation rules should alert on: base64/openssl decode writing to world-writable directories (/tmp, /var/tmp, /dev/shm) followed by chmod +x within a short time window.

What is T1140 Deobfuscate/Decode Files or Information?

MITRE ATT&CK

Data Sources

Required Tables

False Positives

Data Sources

Required Sourcetypes

False Positives

Data Sources

Required Tables

False Positives

Data Sources

Required Tables

False Positives

Data Sources

Required Tables

False Positives

Data Sources

Required Tables

False Positives

Data Sources

Required Tables

False Positives

Sigma rule & cross-platform mapping

Platform-specific guides for T1140

Testing Methodology

Response Playbook

Triage

Containment

Evidence Collection

Escalation Criteria

Investigation Guide

Forensic Artifacts

Tuning Guidance

Hunting Queries

Atomic Red Team Tests

Command

Cleanup

Expected Telemetry

Expected Detection

Command

Expected Telemetry

Expected Detection

Command

Cleanup

Expected Telemetry

Expected Detection

Command

Cleanup

Expected Telemetry

Expected Detection

Command

Cleanup

Expected Telemetry

Expected Detection

Related Detections

Tactic Hub

Related Techniques

Same Tactic: Defense Evasion

Popular Detections

Get new detections in your inbox