T1140 Elastic Security · Elastic

Detect Deobfuscate/Decode Files or Information in Elastic Security

Adversaries may use Obfuscated Files or Information to conceal artifacts of an intrusion. They require separate mechanisms to decode or deobfuscate that information before use. Common methods include using certutil.exe to Base64-decode payloads disguised as certificate files, PowerShell's [Convert]::FromBase64String() to decode strings in memory, cmd.exe copy /b or type commands to reassemble binary fragments, and scripting languages (Python, VBScript) to perform XOR or RC4 decryption at runtime. These techniques allow adversaries to bypass static signature detection by staging encoded payloads and decoding them only at execution time.

MITRE ATT&CK

Tactic
Defense Evasion
Technique
T1140 Deobfuscate/Decode Files or Information
Canonical reference
https://attack.mitre.org/techniques/T1140/

Elastic Detection Query

Elastic Security (Elastic)
eql 
sequence by host.name with maxspan=5m
  [process where event.type == "start" and
    (
      (process.name : "certutil.exe" and process.args : ("-decode", "-decodehex", "-urlcache", "-decodetohex", "-f")) or
      (process.name : ("powershell.exe", "pwsh.exe") and
        process.command_line : ("*FromBase64String*", "*[Convert]::*", "*[System.Convert]::*", "*IO.MemoryStream*", "*GZipStream*", "*DeflateStream*", "*IO.Compression*", "*::Decompress*")) or
      (process.name : "cmd.exe" and process.command_line : ("*copy /b*", "*copy /B*")) or
      (process.name : ("expand.exe", "extrac32.exe") and
        process.command_line : ("*.cab*", "*.zip*", "*.dat*", "*.bin*", "*.txt*", "*.jpg*", "*.png*", "*.tmp*"))
    )
  ] by process.pid

any where
  (
    (process.name : "certutil.exe" and process.args : ("-decode", "-decodehex", "-urlcache", "-decodetohex", "-f")) or
    (process.name : ("powershell.exe", "pwsh.exe") and
      process.command_line : ("*FromBase64String*", "*[Convert]::*", "*[System.Convert]::*", "*IO.MemoryStream*", "*GZipStream*", "*DeflateStream*", "*IO.Compression*", "*::Decompress*")) or
    (process.name : "cmd.exe" and process.command_line : ("*copy /b*", "*copy /B*")) or
    (process.name : ("expand.exe", "extrac32.exe"))
  ) and
  process.parent.name : ("wscript.exe", "cscript.exe", "mshta.exe", "winword.exe", "excel.exe", "outlook.exe", "rundll32.exe", "regsvr32.exe", "msbuild.exe", "installutil.exe", "regasm.exe")
high severity high confidence

Detects deobfuscation and decoding activity consistent with T1140 across four sub-branches: certutil decode flags, PowerShell Base64/GZip/Deflate decompression, cmd.exe binary fragment reassembly via copy /b, and LOLBin CAB extraction via expand.exe or extrac32.exe. The sequence query escalates fidelity by correlating decode activity with a suspicious parent process within a 5-minute window.

Data Sources

Elastic Endpoint SecurityWindows Security EventsSysmon via Elastic Agent

Required Tables

logs-endpoint.events.process-*winlogbeat-*

False Positives & Tuning

  • IT administrators using certutil.exe to decode legitimate certificate files during PKI operations or troubleshooting.
  • Developers and build systems running PowerShell scripts that use Base64-encoded configuration blobs or compressed payloads embedded in CI/CD pipelines.
  • Software installers and package managers (Chocolatey, Scoop) that use expand.exe or extrac32.exe to extract bundled CAB archives during installation.
Download portable Sigma rule (.yml)

Other platforms for T1140

Microsoft Sentinel (KQL) Splunk (SPL) IBM QRadar (QRadar) Sumo Logic CSE (Sumo) Google Chronicle (YARA-L) CrowdStrike LogScale (LogScale) All platforms (combined) →

Testing Methodology

Validate this detection against 5 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.

  1. Test 1Certutil Base64 Decode — Payload Disguised as Certificate File

    Expected signal: Sysmon Event ID 1: Process Create with Image=certutil.exe, CommandLine containing '-decode C:\ProgramData\payload.txt C:\ProgramData\decoded_output.txt'. Sysmon Event ID 11: File Create for decoded_output.txt. Security Event ID 4688 (if process creation auditing with command line enabled): same certutil invocation captured in Windows Security log.

  2. Test 2PowerShell In-Memory Base64 Decode and Decompress Chain

    Expected signal: Sysmon Event ID 1: Process Create with Image=powershell.exe, CommandLine containing 'FromBase64String', 'IO.MemoryStream', and 'GZipStream'. PowerShell ScriptBlock Logging (Event ID 4104): full script block captured in Microsoft-Windows-PowerShell/Operational log, showing the decompressed payload content. No file creation events — this is an entirely in-memory operation.

  3. Test 3cmd.exe Binary Fragment Reassembly with copy /b

    Expected signal: Sysmon Event ID 1: Process Create with Image=cmd.exe, CommandLine containing 'copy /b' and the fragment paths. Sysmon Event ID 11: File Create events for frag1.dat, frag2.dat, and reassembled.bin. Security Event ID 4688 with command line auditing will capture the copy /b invocation. The output file reassembled.bin in C:\Users\Public is a staging-directory indicator.

  4. Test 4Certutil URL Cache Download and Decode (Simulated Offline)

    Expected signal: Sysmon Event ID 1: Process Create with Image=certutil.exe, CommandLine containing '-urlcache -split -f http://127.0.0.1:8080' and 'C:\Windows\Temp\payload.b64'. Sysmon Event ID 3: Network Connection attempt to 127.0.0.1:8080 (connection will be refused). Windows Prefetch: CERTUTIL.EXE-*.pf updated with execution timestamp. The URL cache is also updated in %APPDATA%\Microsoft\Windows\IECompatCache regardless of download success.

  5. Test 5Linux Base64 Decode of Payload to Staging Directory

    Expected signal: Linux auditd EXECVE records for bash/sh executing 'base64 -d' and 'chmod +x'. Syslog entries capturing the command execution. If Sysmon for Linux is deployed: process creation event with CommandLine containing 'base64 -d' and output redirect to /tmp. File creation event for /tmp/.hidden_payload. The chmod +x on a newly created file in /tmp is an additional behavioral indicator captured as a separate process creation event.

Last updated: 2026-04-18 Research depth: deep
References (9)

Unlock Pro Content

Get the full detection package for T1140 including response playbook, investigation guide, and atomic red team tests.

Response PlaybookInvestigation GuideHunting QueriesAtomic Red Team TestsTuning Guidance
Sign Up for Pro View Pricing

Related Detections

Related Techniques

T1027Obfuscated Files or InformationT1027.001Binary PaddingT1027.002Software PackingT1027.010Command ObfuscationT1059.001PowerShellT1059.003Windows Command ShellT1105Ingress Tool TransferT1204.002Malicious FileT1218.003CMSTPT1036MasqueradingT1055Process Injection

Same Tactic: Defense Evasion

Popular Detections