Detect Deobfuscate/Decode Files or Information in Microsoft Sentinel
Adversaries may use Obfuscated Files or Information to conceal artifacts of an intrusion. They require separate mechanisms to decode or deobfuscate that information before use. Common methods include using certutil.exe to Base64-decode payloads disguised as certificate files, PowerShell's [Convert]::FromBase64String() to decode strings in memory, cmd.exe copy /b or type commands to reassemble binary fragments, and scripting languages (Python, VBScript) to perform XOR or RC4 decryption at runtime. These techniques allow adversaries to bypass static signature detection by staging encoded payloads and decoding them only at execution time.
MITRE ATT&CK
- Tactic
- Defense Evasion
- Canonical reference
- https://attack.mitre.org/techniques/T1140/
KQL Detection Query
let CertutilDecodePatterns = dynamic([
"-decode", "-decodehex", "-urlcache", "-f -split", "-decodetohex"
]);
let PowerShellDecodePatterns = dynamic([
"FromBase64String", "[Convert]::", "[System.Convert]::",
"IO.MemoryStream", "GZipStream", "DeflateStream",
"System.IO.Compression", "::Decompress"
]);
let CmdReassemblyPatterns = dynamic([
"copy /b", "type ", "copy /B"
]);
let OtherDecodeTools = dynamic([
"expand.exe", "extrac32.exe", "certutil"
]);
// Branch 1: certutil decode activity
let CertutilEvents = DeviceProcessEvents
| where Timestamp > ago(24h)
| where FileName =~ "certutil.exe"
| where ProcessCommandLine has_any (CertutilDecodePatterns)
| extend DecodeMethod = "certutil"
| extend Indicator = extract(@"(-decode|-decodehex|-urlcache|-split)", 0, tolower(ProcessCommandLine))
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine,
InitiatingProcessFileName, InitiatingProcessCommandLine,
InitiatingProcessAccountName, FolderPath, DecodeMethod, Indicator;
// Branch 2: PowerShell in-memory decode/decompress
let PSDecodeEvents = DeviceProcessEvents
| where Timestamp > ago(24h)
| where FileName in~ ("powershell.exe", "pwsh.exe")
| where ProcessCommandLine has_any (PowerShellDecodePatterns)
| extend DecodeMethod = "powershell-base64"
| extend Indicator = case(
ProcessCommandLine has "FromBase64String", "FromBase64String",
ProcessCommandLine has "GZipStream", "GZip-Decompress",
ProcessCommandLine has "DeflateStream", "Deflate-Decompress",
"base64-decode"
)
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine,
InitiatingProcessFileName, InitiatingProcessCommandLine,
InitiatingProcessAccountName, FolderPath, DecodeMethod, Indicator;
// Branch 3: cmd.exe binary fragment reassembly
let CmdReassemblyEvents = DeviceProcessEvents
| where Timestamp > ago(24h)
| where FileName =~ "cmd.exe"
| where ProcessCommandLine has "copy /b" or ProcessCommandLine has "copy /B"
| where ProcessCommandLine matches regex @"copy\s+/[bB].*\.(bin|dat|txt|jpg|png|pdf|tmp|log)"
| extend DecodeMethod = "cmd-copy-reassembly"
| extend Indicator = "binary-fragment-reassembly"
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine,
InitiatingProcessFileName, InitiatingProcessCommandLine,
InitiatingProcessAccountName, FolderPath, DecodeMethod, Indicator;
// Branch 4: expand.exe / extrac32 abuse for CAB extraction of hidden payloads
let ExpandEvents = DeviceProcessEvents
| where Timestamp > ago(24h)
| where FileName in~ ("expand.exe", "extrac32.exe")
| where ProcessCommandLine matches regex @"\.(cab|zip|dat|bin|txt|jpg|png|tmp)"
| extend DecodeMethod = FileName
| extend Indicator = "lolbin-cab-extract"
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine,
InitiatingProcessFileName, InitiatingProcessCommandLine,
InitiatingProcessAccountName, FolderPath, DecodeMethod, Indicator;
// Union all branches and enrich
CertutilEvents
| union PSDecodeEvents, CmdReassemblyEvents, ExpandEvents
| extend SuspiciousParent = InitiatingProcessFileName in~ (
"wscript.exe", "cscript.exe", "mshta.exe", "winword.exe",
"excel.exe", "outlook.exe", "rundll32.exe", "regsvr32.exe",
"msbuild.exe", "installutil.exe", "regasm.exe"
)
| extend HighPrivilege = AccountName in~ ("SYSTEM", "Administrator") or
InitiatingProcessAccountName in~ ("SYSTEM", "Administrator")
| extend RiskScore = case(
SuspiciousParent and HighPrivilege, 3,
SuspiciousParent or HighPrivilege, 2,
1
)
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine,
InitiatingProcessFileName, InitiatingProcessCommandLine,
DecodeMethod, Indicator, SuspiciousParent, HighPrivilege, RiskScore
| sort by RiskScore desc, Timestamp descDetects deobfuscation and decoding activity using multiple vectors: (1) certutil.exe with -decode/-decodehex flags commonly used to decode Base64-encoded payloads embedded in fake certificate files; (2) PowerShell FromBase64String, GZipStream, and DeflateStream patterns indicating in-memory decode/decompress chains; (3) cmd.exe copy /b binary fragment reassembly to reconstruct malicious payloads split across innocuous-looking files; (4) expand.exe and extrac32.exe abuse to extract payloads from CAB archives disguised as common file types. Results are scored by parent process risk and privilege context.
Data Sources
Required Tables
False Positives & Tuning
- Software installation scripts using certutil to download and decode legitimate certificate files during provisioning workflows
- IT automation tools (SCCM, Ansible, Chef) using PowerShell Base64 encoding to safely pass configuration parameters that contain special characters
- Security scanning or vulnerability assessment tools that use certutil for certificate chain validation and CRL download
- Legitimate software updaters that use expand.exe or extrac32.exe to unpack update packages delivered as CAB files
- Developers testing encoding/decoding routines on workstations — typically identifiable by IDE parent processes and developer machine naming conventions
Other platforms for T1140
Testing Methodology
Validate this detection against 5 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Certutil Base64 Decode — Payload Disguised as Certificate File
Expected signal: Sysmon Event ID 1: Process Create with Image=certutil.exe, CommandLine containing '-decode C:\ProgramData\payload.txt C:\ProgramData\decoded_output.txt'. Sysmon Event ID 11: File Create for decoded_output.txt. Security Event ID 4688 (if process creation auditing with command line enabled): same certutil invocation captured in Windows Security log.
- Test 2PowerShell In-Memory Base64 Decode and Decompress Chain
Expected signal: Sysmon Event ID 1: Process Create with Image=powershell.exe, CommandLine containing 'FromBase64String', 'IO.MemoryStream', and 'GZipStream'. PowerShell ScriptBlock Logging (Event ID 4104): full script block captured in Microsoft-Windows-PowerShell/Operational log, showing the decompressed payload content. No file creation events — this is an entirely in-memory operation.
- Test 3cmd.exe Binary Fragment Reassembly with copy /b
Expected signal: Sysmon Event ID 1: Process Create with Image=cmd.exe, CommandLine containing 'copy /b' and the fragment paths. Sysmon Event ID 11: File Create events for frag1.dat, frag2.dat, and reassembled.bin. Security Event ID 4688 with command line auditing will capture the copy /b invocation. The output file reassembled.bin in C:\Users\Public is a staging-directory indicator.
- Test 4Certutil URL Cache Download and Decode (Simulated Offline)
Expected signal: Sysmon Event ID 1: Process Create with Image=certutil.exe, CommandLine containing '-urlcache -split -f http://127.0.0.1:8080' and 'C:\Windows\Temp\payload.b64'. Sysmon Event ID 3: Network Connection attempt to 127.0.0.1:8080 (connection will be refused). Windows Prefetch: CERTUTIL.EXE-*.pf updated with execution timestamp. The URL cache is also updated in %APPDATA%\Microsoft\Windows\IECompatCache regardless of download success.
- Test 5Linux Base64 Decode of Payload to Staging Directory
Expected signal: Linux auditd EXECVE records for bash/sh executing 'base64 -d' and 'chmod +x'. Syslog entries capturing the command execution. If Sysmon for Linux is deployed: process creation event with CommandLine containing 'base64 -d' and output redirect to /tmp. File creation event for /tmp/.hidden_payload. The chmod +x on a newly created file in /tmp is an additional behavioral indicator captured as a separate process creation event.
References (9)
- https://attack.mitre.org/techniques/T1140/
- https://blog.malwarebytes.com/cybercrime/social-engineering-cybercrime/2017/03/new-targeted-attack-saudi-arabia-government/
- https://www.carbonblack.com/2016/09/23/security-advisory-variants-well-known-adware-families-discovered-include-sophisticated-obfuscation-techniques-previously-associated-nation-state-attacks/
- https://www.sentinelone.com/labs/operation-tainted-love-chinese-apts-target-telcos-in-new-attacks/
- https://www.volexity.com/blog/2016/11/09/powerduke-post-election-spear-phishing-campaigns-targeting-think-tanks-and-ngos/
- https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/certutil
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1140/T1140.md
- https://lolbas-project.github.io/lolbas/Binaries/Certutil/
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_certutil_decode.yml
Unlock Pro Content
Get the full detection package for T1140 including response playbook, investigation guide, and atomic red team tests.