{"source_checked_on":"2026-10-19","schema_version":1,"key":"enterprise/T1027","id":"T1027","name":"Obfuscated Files or Information","domain":"enterprise","reviewed_on":"2026-09-28","source_url":"https://attack.mitre.org/techniques/T1027","source_file":{"file":"enterprise.json","url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/20664a889568dce884a1dac0ec7b12ae3a199f51/enterprise-attack/enterprise-attack-20.0.json","sha256":"81113ba98afa2928f3dcff62022539f7ce30c315c32e14422f11ff95ce534352","bytes":55271014},"source_object_sha256":"394039347f19b48831a7d01078611bf78e7548b2991813ce673d3e16594ba037","description":"Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses. \n\nPayloads may be compressed, archived, or encrypted in order to avoid detection. These payloads may be used during Initial Access or later to mitigate detection. Sometimes a user's action may be required to open and [Deobfuscate/Decode Files or Information](https://attack.mitre.org/techniques/T1140) for [User Execution](https://attack.mitre.org/techniques/T1204). The user may also be required to input a password to open a password protected compressed/encrypted file that was provided by the adversary.(Citation: Volexity PowerDuke November 2016) Adversaries may also use compressed or archived scripts, such as JavaScript. \n\nPortions of files can also be encoded to hide the plain-text strings that would otherwise help defenders with discovery.(Citation: Linux/Cdorked.A We Live Security Analysis) Payloads may also be split into separate, seemingly benign files that only reveal malicious functionality when reassembled.(Citation: Carbon Black Obfuscation Sept 2016)\n\nAdversaries may also abuse [Command Obfuscation](https://attack.mitre.org/techniques/T1027/010) to obscure commands executed from payloads or directly via [Command and Scripting Interpreter](https://attack.mitre.org/techniques/T1059). Environment variables, aliases, characters, and other platform/language specific semantics can be used to evade signature based detections and application control mechanisms.(Citation: FireEye Obfuscation June 2017)(Citation: FireEye Revoke-Obfuscation July 2017)(Citation: PaloAlto EncodedCommand March 2017) ","references":[{"source_name":"mitre-attack","url":"https://attack.mitre.org/techniques/T1027","external_id":"T1027"},{"source_name":"Volexity PowerDuke November 2016","description":"Adair, S.. (2016, November 9). PowerDuke: Widespread Post-Election Spear Phishing Campaigns Targeting Think Tanks and NGOs. Retrieved January 11, 2017.","url":"https://www.volexity.com/blog/2016/11/09/powerduke-post-election-spear-phishing-campaigns-targeting-think-tanks-and-ngos/"},{"source_name":"FireEye Obfuscation June 2017","description":"Bohannon, D. & Carr N. (2017, June 30). Obfuscation in the Wild: Targeted Attackers Lead the Way in Evasion Techniques. Retrieved February 12, 2018.","url":"https://web.archive.org/web/20170923102302/https://www.fireeye.com/blog/threat-research/2017/06/obfuscation-in-the-wild.html"},{"source_name":"FireEye Revoke-Obfuscation July 2017","description":"Bohannon, D. & Holmes, L. (2017, July 27). Revoke-Obfuscation: PowerShell Obfuscation Detection Using Science. Retrieved November 17, 2024.","url":"https://www.blackhat.com/docs/us-17/thursday/us-17-Bohannon-Revoke-Obfuscation-PowerShell-Obfuscation-Detection-And%20Evasion-Using-Science-wp.pdf"},{"source_name":"Linux/Cdorked.A We Live Security Analysis","description":"Pierre-Marc Bureau. (2013, April 26). Linux/Cdorked.A: New Apache backdoor being used in the wild to serve Blackhole. Retrieved September 10, 2017.","url":"https://www.welivesecurity.com/2013/04/26/linuxcdorked-new-apache-backdoor-in-the-wild-serves-blackhole/"},{"source_name":"Carbon Black Obfuscation Sept 2016","description":"Tedesco, B. (2016, September 23). Security Alert Summary. Retrieved February 12, 2018.","url":"https://www.carbonblack.com/2016/09/23/security-advisory-variants-well-known-adware-families-discovered-include-sophisticated-obfuscation-techniques-previously-associated-nation-state-attacks/"},{"source_name":"PaloAlto EncodedCommand March 2017","description":"White, J. (2017, March 10). Pulling Back the Curtains on EncodedCommand PowerShell Attacks. Retrieved February 12, 2018.","url":"https://researchcenter.paloaltonetworks.com/2017/03/unit42-pulling-back-the-curtains-on-encodedcommand-powershell-attacks/"}],"platforms":["ESXi","Linux","macOS","Network Devices","Windows"],"environments":["cloud-hosted-endpoint","network-infrastructure","onprem","virtualization"],"visibility":"source_mapped","visibility_note":null,"parent":null,"children":[{"key":"enterprise/T1027.001","id":"T1027.001","name":"Binary Padding","page":"techniques/enterprise/T1027.001/"},{"key":"enterprise/T1027.002","id":"T1027.002","name":"Software Packing","page":"techniques/enterprise/T1027.002/"},{"key":"enterprise/T1027.003","id":"T1027.003","name":"Steganography","page":"techniques/enterprise/T1027.003/"},{"key":"enterprise/T1027.004","id":"T1027.004","name":"Compile After Delivery","page":"techniques/enterprise/T1027.004/"},{"key":"enterprise/T1027.005","id":"T1027.005","name":"Indicator Removal from Tools","page":"techniques/enterprise/T1027.005/"},{"key":"enterprise/T1027.006","id":"T1027.006","name":"HTML Smuggling","page":"techniques/enterprise/T1027.006/"},{"key":"enterprise/T1027.007","id":"T1027.007","name":"Dynamic API Resolution","page":"techniques/enterprise/T1027.007/"},{"key":"enterprise/T1027.008","id":"T1027.008","name":"Stripped Payloads","page":"techniques/enterprise/T1027.008/"},{"key":"enterprise/T1027.009","id":"T1027.009","name":"Embedded Payloads","page":"techniques/enterprise/T1027.009/"},{"key":"enterprise/T1027.010","id":"T1027.010","name":"Command Obfuscation","page":"techniques/enterprise/T1027.010/"},{"key":"enterprise/T1027.011","id":"T1027.011","name":"Fileless Storage","page":"techniques/enterprise/T1027.011/"},{"key":"enterprise/T1027.012","id":"T1027.012","name":"LNK Icon Smuggling","page":"techniques/enterprise/T1027.012/"},{"key":"enterprise/T1027.013","id":"T1027.013","name":"Encrypted/Encoded File","page":"techniques/enterprise/T1027.013/"},{"key":"enterprise/T1027.014","id":"T1027.014","name":"Polymorphic Code","page":"techniques/enterprise/T1027.014/"},{"key":"enterprise/T1027.015","id":"T1027.015","name":"Compression","page":"techniques/enterprise/T1027.015/"},{"key":"enterprise/T1027.016","id":"T1027.016","name":"Junk Code Insertion","page":"techniques/enterprise/T1027.016/"},{"key":"enterprise/T1027.017","id":"T1027.017","name":"SVG Smuggling","page":"techniques/enterprise/T1027.017/"},{"key":"enterprise/T1027.018","id":"T1027.018","name":"Invisible Unicode","page":"techniques/enterprise/T1027.018/"}],"telemetry":[{"id":"DC0064","name":"Command Execution","page":"telemetry/DC0064/","kind":"attack_component","category":"Script and command execution","description":"Execution of a command and its interpreter or parent context.","collection_focus":"Collect process command lines and relevant shell/interpreter audit; shell history alone is neither complete nor tamper-resistant.","providers":[{"name":"PowerShell Script Block Logging","scope":"Script content via event 4104 when configured; channel depends on PowerShell edition.","source_id":"powershell"},{"name":"Sysmon process events","scope":"Interpreter launch and parent context, not full script content.","source_id":"sysmon"},{"name":"Linux Audit","scope":"execve-family execution context; shell built-ins need additional instrumentation.","source_id":"linux"}],"configuration":["Enable Script Block Logging through the policy/configuration for the installed edition. Forward Microsoft-Windows-PowerShell/Operational for Windows PowerShell, or PowerShellCore/Operational for PowerShell 7.","Retain script-block ID and fragment ordering alongside process creation. Protect access to collected script text; secrets may be included.","On Linux, use narrowly scoped Audit execution rules for the lab account and supported architectures, and retain joined SYSCALL/EXECVE/PATH records."],"configuration_example":null,"required_fields":["interpreter","command_line","actor_uid","session_id"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0064","collector":"illustrative-lab-collector","observation":{"interpreter":"/bin/sh","command_line":"printf LAB_TELEMETRY_CHECK","actor_uid":1000,"session_id":"lab-session-1"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Script content and process command lines are different signals. Logging may be partial, fragmented, filtered or disabled; never assume a command line reveals everything executed.","sources":[{"id":"powershell","title":"Microsoft PowerShell logging on Windows","url":"https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.core/about/about_logging_windows?view=powershell-7.5"},{"id":"sysmon","title":"Microsoft Sysmon events and configuration","url":"https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon"},{"id":"linux","title":"Linux Audit rule configuration","url":"https://www.man7.org/linux/man-pages/man8/auditctl.8.html"}],"association":"attack_component","anomaly_design":"Per host role and principal: rare interpreters, command argument patterns and parent-child sequences. Normalize scripts carefully; obfuscation, administrative automation and missing command lines change visibility."},{"id":"DC0039","name":"File Creation","page":"telemetry/DC0039/","kind":"attack_component","category":"Endpoint activity","description":"Creation or overwrite of a file at an observed path.","collection_focus":"Scope Sysmon FileCreate (11) to the lab directory; retain the process and file path. Differentiate creation/overwrite if the sensor can.","providers":[{"name":"Microsoft Sysmon","scope":"Windows event-based collection; enable the event types needed below.","source_id":"sysmon"},{"name":"Linux Audit","scope":"Linux alternative for supported system-call and file events; different semantics and fields.","source_id":"linux"},{"name":"Apple Endpoint Security clients","scope":"macOS alternative where the subscribed event exists; requires an entitled, approved client, not an iOS collector.","source_id":"apple"}],"configuration":["On a disposable Windows host, review the installed Sysmon schema and current configuration; merge scoped event filters into the existing policy rather than replacing it.","Forward Microsoft-Windows-Sysmon/Operational to the lab collector. Preserve event ID, timestamp, computer, process identifiers and the original event.","For Linux or macOS, select the equivalent sensor separately and test its emitted fields; a Windows event ID does not transfer across platforms."],"configuration_example":null,"required_fields":["process_id","path","action","size_bytes"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0039","collector":"illustrative-lab-collector","observation":{"process_id":4200,"path":"C:\\Lab\\demo.txt","action":"create","size_bytes":64}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Event filtering and sensor versions change coverage. High-volume image-load and process-access collection needs tuning; endpoint events alone do not establish intent.","sources":[{"id":"sysmon","title":"Microsoft Sysmon events and configuration","url":"https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon"},{"id":"sysmon_config","title":"Microsoft Sysmon configuration files","url":"https://learn.microsoft.com/en-us/windows/security/operating-system-security/sysmon/sysmon-configuration-files"},{"id":"linux","title":"Linux Audit rule configuration","url":"https://www.man7.org/linux/man-pages/man8/auditctl.8.html"},{"id":"apple","title":"Apple Endpoint Security framework for macOS","url":"https://developer.apple.com/documentation/endpointsecurity"},{"id":"process_audit","title":"Microsoft process creation event 4688","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4688"}],"association":"attack_component","anomaly_design":"Per host role and user: rare process/object combinations, bursts of object access or modification, and ordered parent/action sequences. Compare maintenance windows and signed software rollout activity."},{"id":"DC0059","name":"File Metadata","page":"telemetry/DC0059/","kind":"attack_component","category":"Host state and inventory","description":"File attributes such as path, size, timestamps, ownership and cryptographic hash.","collection_focus":"Collect scoped file inventory/FIM metadata with hash algorithm and observation time; preserve original timestamps separately from collector time.","providers":[{"name":"osquery","scope":"Scheduled host-state queries; supported tables and privileges vary by OS. Select a table that actually exposes the required object.","source_id":"osquery"},{"name":"Linux Audit plus inventory snapshots","scope":"Events explain changes; snapshots describe state at collection time.","source_id":"linux"}],"configuration":["Define the inventory query, allowed host set, interval and least-privileged reader. Store a stable asset ID, observation time and collector version.","Keep successive snapshots and calculate additions, removals and changed attributes. Pair state changes with audit events when available.","Export collector health and missed-poll counts so a missing snapshot is not misclassified as a missing asset."],"configuration_example":null,"required_fields":["path","size_bytes","sha256","owner_uid"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0059","collector":"illustrative-lab-collector","observation":{"path":"/opt/lab/demo.txt","size_bytes":64,"sha256":"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa","owner_uid":1000}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Snapshots miss short-lived objects and do not identify who caused a change. A generic inventory agent is not guaranteed to expose firmware or kernel-level details.","sources":[{"id":"osquery","title":"osquery scheduled configuration","url":"https://github.com/osquery/osquery/blob/master/docs/wiki/deployment/configuration.md"},{"id":"linux","title":"Linux Audit rule configuration","url":"https://www.man7.org/linux/man-pages/man8/auditctl.8.html"}],"association":"attack_component","anomaly_design":"Compare authorized state snapshots: first-seen drivers/services/modules, unexpected configuration drift and integrity changes. Record collection cadence; absence in a sample is not evidence of deletion."},{"id":"DC0061","name":"File Modification","page":"telemetry/DC0061/","kind":"attack_component","category":"Endpoint activity","description":"Changes to file data or attributes.","collection_focus":"Use file-integrity monitoring or scoped OS file-write auditing for general changes. Sysmon 2 records creation-time changes; it is not a general file-write event.","providers":[{"name":"Microsoft Sysmon","scope":"Windows event-based collection; enable the event types needed below.","source_id":"sysmon"},{"name":"Linux Audit","scope":"Linux alternative for supported system-call and file events; different semantics and fields.","source_id":"linux"},{"name":"Apple Endpoint Security clients","scope":"macOS alternative where the subscribed event exists; requires an entitled, approved client, not an iOS collector.","source_id":"apple"}],"configuration":["On a disposable Windows host, review the installed Sysmon schema and current configuration; merge scoped event filters into the existing policy rather than replacing it.","Forward Microsoft-Windows-Sysmon/Operational to the lab collector. Preserve event ID, timestamp, computer, process identifiers and the original event.","For Linux or macOS, select the equivalent sensor separately and test its emitted fields; a Windows event ID does not transfer across platforms."],"configuration_example":null,"required_fields":["path","attribute","before","after"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0061","collector":"illustrative-lab-collector","observation":{"path":"C:\\Lab\\demo.txt","attribute":"content_hash","before":"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa","after":"bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Event filtering and sensor versions change coverage. High-volume image-load and process-access collection needs tuning; endpoint events alone do not establish intent.","sources":[{"id":"sysmon","title":"Microsoft Sysmon events and configuration","url":"https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon"},{"id":"sysmon_config","title":"Microsoft Sysmon configuration files","url":"https://learn.microsoft.com/en-us/windows/security/operating-system-security/sysmon/sysmon-configuration-files"},{"id":"linux","title":"Linux Audit rule configuration","url":"https://www.man7.org/linux/man-pages/man8/auditctl.8.html"},{"id":"apple","title":"Apple Endpoint Security framework for macOS","url":"https://developer.apple.com/documentation/endpointsecurity"},{"id":"process_audit","title":"Microsoft process creation event 4688","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4688"}],"association":"attack_component","anomaly_design":"Per host role and user: rare process/object combinations, bursts of object access or modification, and ordered parent/action sequences. Compare maintenance windows and signed software rollout activity."},{"id":"DC0085","name":"Network Traffic Content","page":"telemetry/DC0085/","kind":"attack_component","category":"Network and protocol telemetry","description":"Packet or decoded application-protocol content visible at a network sensor.","collection_focus":"Scope approved packet capture/protocol content collection to the lab flow; retain capture provenance and truncation indicators.","providers":[{"name":"Zeek","scope":"Connection and protocol metadata from traffic visible to the sensor.","source_id":"zeek"},{"name":"Suricata EVE","scope":"Configured flow, alert, DNS, HTTP, TLS and protocol records.","source_id":"suricata"}],"configuration":["Use an authorized lab TAP/SPAN, virtual mirror or gateway interface. Define which traffic crosses it; avoid assuming visibility into every segment.","Enable the required Zeek analyzers or Suricata EVE event types. Export logs with sensor identity, clock synchronization and flow correlation identifiers.","Monitor capture loss, truncation and exporter sampling. Capture payload only with approval and restrictive retention; encryption normally prevents plaintext inspection."],"configuration_example":null,"required_fields":["flow_id","protocol","method","path","payload_excerpt"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0085","collector":"illustrative-lab-collector","observation":{"flow_id":"lab-flow-1","protocol":"http","method":"GET","path":"/lab-check","payload_excerpt":"LAB_TELEMETRY_CHECK"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Flows are not packet payloads. NAT, asymmetric routes, encryption, missing mirrors and sampling can hide attribution or content. A destination connection alone does not prove malicious intent.","sources":[{"id":"zeek","title":"Zeek protocol and connection logs","url":"https://docs.zeek.org/en/current/reference/logs/index.html"},{"id":"zeek_start","title":"Zeek capture setup","url":"https://docs.zeek.org/en/current/quickstart.html"},{"id":"suricata","title":"Suricata EVE JSON output","url":"https://docs.suricata.io/en/latest/output/eve/eve-json-output.html"}],"association":"attack_component","anomaly_design":"Per source and observation point: connection rate, destination-host/port fan-out, response/failure ratio and previously unseen destinations. Compare equivalent time windows; separate authorized scanners, NAT and sampling effects."},{"id":"DC0021","name":"OS API Execution","page":"telemetry/DC0021/","kind":"attack_component","category":"Application and service audit","description":"Instrumented operating-system API calls and their return values.","collection_focus":"Use an approved EDR trace or instrument the owned lab process at selected APIs. Define API name, caller, sanitized arguments and return status.","providers":[{"name":"Application audit logs","scope":"First-party service events and request/result fields; schema is application-specific.","source_id":"otel"},{"name":"OpenTelemetry-compatible log pipelines","scope":"Transport and normalization of emitted records; do not create missing audit instrumentation.","source_id":"otel"}],"configuration":["Enable the application audit category or instrument the owned lab application at the authorization/action boundary.","Define a schema with timestamp, service, actor, object, action, result and correlation ID. Export structured records through an authenticated collector.","Redact secrets and personal content, separate audit from debug logs, set retention and verify delivery during rotation/restart."],"configuration_example":null,"required_fields":["process_id","api","path","result"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0021","collector":"illustrative-lab-collector","observation":{"process_id":4200,"api":"CreateFileW","path":"C:\\Lab\\demo.txt","result":"success"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Debug output is not necessarily a durable audit trail. Application developers must emit the relevant event; installing a log pipeline does not make an absent event exist.","sources":[{"id":"otel","title":"OpenTelemetry log data model","url":"https://opentelemetry.io/docs/specs/otel/logs/data-model/"}],"association":"attack_component","anomaly_design":"Per application, client and route: request rate, rare actions, failure ratios and unusual state transitions. Version changes, retries, health probes and seasonal load need separate baselines."},{"id":"DC0032","name":"Process Creation","page":"telemetry/DC0032/","kind":"attack_component","category":"Endpoint activity","description":"Creation of a process with executable, command line, parent and security context.","collection_focus":"Collect Sysmon ProcessCreate (1); preserve ProcessGuid and parent identifiers. Security 4688 is an alternative with separate audit/command-line settings.","providers":[{"name":"Microsoft Sysmon","scope":"Windows event-based collection; enable the event types needed below.","source_id":"sysmon"},{"name":"Linux Audit","scope":"Linux alternative for supported system-call and file events; different semantics and fields.","source_id":"linux"},{"name":"Apple Endpoint Security clients","scope":"macOS alternative where the subscribed event exists; requires an entitled, approved client, not an iOS collector.","source_id":"apple"}],"configuration":["On a disposable Windows host, review the installed Sysmon schema and current configuration; merge scoped event filters into the existing policy rather than replacing it.","Forward Microsoft-Windows-Sysmon/Operational to the lab collector. Preserve event ID, timestamp, computer, process identifiers and the original event.","For Linux or macOS, select the equivalent sensor separately and test its emitted fields; a Windows event ID does not transfer across platforms."],"configuration_example":{"label":"Sysmon filter fragment · merge into the reviewed lab configuration","language":"xml","source_id":"sysmon_config","content":"<EventFiltering>\n  <ProcessCreate onmatch=\"include\">\n    <Image condition=\"is\">C:\\Windows\\System32\\whoami.exe</Image>\n  </ProcessCreate>\n</EventFiltering>","note":"This fragment only selects the named process. It is not a complete production policy. Inspect the installed schema with sysmon64 -s; preserve existing rules, then apply the reviewed complete configuration with sysmon64 -c <configuration-file>."},"required_fields":["process_guid","image","parent_image","command_line","user"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0032","collector":"illustrative-lab-collector","observation":{"process_guid":"lab-process-001","image":"C:\\Windows\\System32\\whoami.exe","parent_image":"C:\\Windows\\System32\\cmd.exe","command_line":"whoami","user":"LAB\\analyst"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Event filtering and sensor versions change coverage. High-volume image-load and process-access collection needs tuning; endpoint events alone do not establish intent.","sources":[{"id":"sysmon","title":"Microsoft Sysmon events and configuration","url":"https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon"},{"id":"sysmon_config","title":"Microsoft Sysmon configuration files","url":"https://learn.microsoft.com/en-us/windows/security/operating-system-security/sysmon/sysmon-configuration-files"},{"id":"linux","title":"Linux Audit rule configuration","url":"https://www.man7.org/linux/man-pages/man8/auditctl.8.html"},{"id":"apple","title":"Apple Endpoint Security framework for macOS","url":"https://developer.apple.com/documentation/endpointsecurity"},{"id":"process_audit","title":"Microsoft process creation event 4688","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4688"}],"association":"attack_component","anomaly_design":"Per host role and user: rare process/object combinations, bursts of object access or modification, and ordered parent/action sequences. Compare maintenance windows and signed software rollout activity."}],"detection":{"key":"enterprise/T1027","id":"T1027","name":"Obfuscated Files or Information","domain":"enterprise","platforms":["ESXi","Linux","macOS","Network Devices","Windows"],"environments":["cloud-hosted-endpoint","network-infrastructure","onprem","virtualization"],"source_url":"https://attack.mitre.org/techniques/T1027","technique_page":"techniques/enterprise/T1027/","page":"detections/enterprise/T1027/","status":"rule_source_available","counts":{"sigma":87,"atlas_basic":1,"atlas_anomaly":1,"strategies":1,"analytics":5,"live_validated":0},"sigma_rules":[{"id":"179b3686-6271-4d87-807d-17d843a8af73","title":"Suspicious Filename with Embedded Base64 Commands","status":"experimental","level":"high","logsource":{"product":"linux","category":"file_event"},"data_path":"data/detection-rules/179b3686-6271-4d87-807d-17d843a8af73.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/linux/file_event/file_event_lnx_susp_filename_with_embedded_base64_command.yml","author":"@kostastsale","kind":"sigma"},{"id":"e2072cab-8c9a-459b-b63c-40ae79e27031","title":"Decode Base64 Encoded Text","status":"test","level":"low","logsource":{"category":"process_creation","product":"linux"},"data_path":"data/detection-rules/e2072cab-8c9a-459b-b63c-40ae79e27031.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/linux/process_creation/proc_creation_lnx_base64_decode.yml","author":"Daniil Yugoslavskiy, oscd.community","kind":"sigma"},{"id":"719c22d7-c11a-4f2c-93a6-2cfdd5412f68","title":"Decode Base64 Encoded Text -MacOs","status":"test","level":"low","logsource":{"category":"process_creation","product":"macos"},"data_path":"data/detection-rules/719c22d7-c11a-4f2c-93a6-2cfdd5412f68.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/macos/process_creation/proc_creation_macos_base64_decode.yml","author":"Daniil Yugoslavskiy, oscd.community","kind":"sigma"},{"id":"4edf51e1-cb83-4e1a-bc39-800e396068e3","title":"Invoke-Obfuscation CLIP+ Launcher - Security","status":"test","level":"high","logsource":{"product":"windows","service":"security","definition":"The 'System Security Extension' audit subcategory need to be enabled to log the EID 4697"},"data_path":"data/detection-rules/4edf51e1-cb83-4e1a-bc39-800e396068e3.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/builtin/security/win_security_invoke_obfuscation_clip_services_security.yml","author":"Jonathan Cheong, oscd.community","kind":"sigma"},{"id":"fd0f5778-d3cb-4c9a-9695-66759d04702a","title":"Invoke-Obfuscation Obfuscated IEX Invocation - Security","status":"test","level":"high","logsource":{"product":"windows","service":"security","definition":"The 'System Security Extension' audit subcategory need to be enabled to log the EID 4697"},"data_path":"data/detection-rules/fd0f5778-d3cb-4c9a-9695-66759d04702a.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/builtin/security/win_security_invoke_obfuscation_obfuscated_iex_services_security.yml","author":"Daniel Bohannon (@Mandiant/@FireEye), oscd.community","kind":"sigma"},{"id":"0c718a5e-4284-4fb9-b4d9-b9a50b3a1974","title":"Invoke-Obfuscation STDIN+ Launcher - Security","status":"test","level":"high","logsource":{"product":"windows","service":"security","definition":"The 'System Security Extension' audit subcategory need to be enabled to log the EID 4697"},"data_path":"data/detection-rules/0c718a5e-4284-4fb9-b4d9-b9a50b3a1974.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/builtin/security/win_security_invoke_obfuscation_stdin_services_security.yml","author":"Jonathan Cheong, oscd.community","kind":"sigma"},{"id":"dcf2db1f-f091-425b-a821-c05875b8925a","title":"Invoke-Obfuscation VAR+ Launcher - Security","status":"test","level":"high","logsource":{"product":"windows","service":"security","definition":"The 'System Security Extension' audit subcategory need to be enabled to log the EID 4697"},"data_path":"data/detection-rules/dcf2db1f-f091-425b-a821-c05875b8925a.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/builtin/security/win_security_invoke_obfuscation_var_services_security.yml","author":"Jonathan Cheong, oscd.community","kind":"sigma"},{"id":"7a922f1b-2635-4d6c-91ef-af228b198ad3","title":"Invoke-Obfuscation COMPRESS OBFUSCATION - Security","status":"test","level":"medium","logsource":{"product":"windows","service":"security","definition":"The 'System Security Extension' audit subcategory need to be enabled to log the EID 4697"},"data_path":"data/detection-rules/7a922f1b-2635-4d6c-91ef-af228b198ad3.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/builtin/security/win_security_invoke_obfuscation_via_compress_services_security.yml","author":"Timur Zinniatullin, oscd.community","kind":"sigma"},{"id":"f241cf1b-3a6b-4e1a-b4f9-133c00dd95ca","title":"Invoke-Obfuscation RUNDLL LAUNCHER - Security","status":"test","level":"medium","logsource":{"product":"windows","service":"security","definition":"The 'System Security Extension' audit subcategory need to be enabled to log the EID 4697"},"data_path":"data/detection-rules/f241cf1b-3a6b-4e1a-b4f9-133c00dd95ca.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/builtin/security/win_security_invoke_obfuscation_via_rundll_services_security.yml","author":"Timur Zinniatullin, oscd.community","kind":"sigma"},{"id":"80b708f3-d034-40e4-a6c8-d23b7a7db3d1","title":"Invoke-Obfuscation Via Stdin - Security","status":"test","level":"high","logsource":{"product":"windows","service":"security","definition":"The 'System Security Extension' audit subcategory need to be enabled to log the EID 4697"},"data_path":"data/detection-rules/80b708f3-d034-40e4-a6c8-d23b7a7db3d1.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/builtin/security/win_security_invoke_obfuscation_via_stdin_services_security.yml","author":"Nikita Nazarov, oscd.community","kind":"sigma"},{"id":"1a0a2ff1-611b-4dac-8216-8a7b47c618a6","title":"Invoke-Obfuscation Via Use Clip - Security","status":"test","level":"high","logsource":{"product":"windows","service":"security","definition":"The 'System Security Extension' audit subcategory need to be enabled to log the EID 4697"},"data_path":"data/detection-rules/1a0a2ff1-611b-4dac-8216-8a7b47c618a6.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/builtin/security/win_security_invoke_obfuscation_via_use_clip_services_security.yml","author":"Nikita Nazarov, oscd.community","kind":"sigma"},{"id":"9b8d9203-4e0f-4cd9-bb06-4cc4ea6d0e9a","title":"Invoke-Obfuscation Via Use MSHTA - Security","status":"test","level":"high","logsource":{"product":"windows","service":"security","definition":"The 'System Security Extension' audit subcategory need to be enabled to log the EID 4697"},"data_path":"data/detection-rules/9b8d9203-4e0f-4cd9-bb06-4cc4ea6d0e9a.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/builtin/security/win_security_invoke_obfuscation_via_use_mshta_services_security.yml","author":"Nikita Nazarov, oscd.community","kind":"sigma"},{"id":"cd0f7229-d16f-42de-8fe3-fba365fbcb3a","title":"Invoke-Obfuscation Via Use Rundll32 - Security","status":"test","level":"high","logsource":{"product":"windows","service":"security","definition":"The 'System Security Extension' audit subcategory need to be enabled to log the EID 4697"},"data_path":"data/detection-rules/cd0f7229-d16f-42de-8fe3-fba365fbcb3a.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/builtin/security/win_security_invoke_obfuscation_via_use_rundll32_services_security.yml","author":"Nikita Nazarov, oscd.community","kind":"sigma"},{"id":"4c54ba8f-73d2-4d40-8890-d9cf1dca3d30","title":"Invoke-Obfuscation VAR++ LAUNCHER OBFUSCATION - Security","status":"test","level":"high","logsource":{"product":"windows","service":"security","definition":"The 'System Security Extension' audit subcategory need to be enabled to log the EID 4697"},"data_path":"data/detection-rules/4c54ba8f-73d2-4d40-8890-d9cf1dca3d30.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/builtin/security/win_security_invoke_obfuscation_via_var_services_security.yml","author":"Timur Zinniatullin, oscd.community","kind":"sigma"},{"id":"00ba9da1-b510-4f6b-b258-8d338836180f","title":"Password Protected ZIP File Opened","status":"test","level":"medium","logsource":{"product":"windows","service":"security"},"data_path":"data/detection-rules/00ba9da1-b510-4f6b-b258-8d338836180f.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/builtin/security/win_security_susp_opened_encrypted_zip.yml","author":"Florian Roth (Nextron Systems)","kind":"sigma"},{"id":"54f0434b-726f-48a1-b2aa-067df14516e4","title":"Password Protected ZIP File Opened (Suspicious Filenames)","status":"test","level":"high","logsource":{"product":"windows","service":"security"},"data_path":"data/detection-rules/54f0434b-726f-48a1-b2aa-067df14516e4.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/builtin/security/win_security_susp_opened_encrypted_zip_filename.yml","author":"Florian Roth (Nextron Systems)","kind":"sigma"},{"id":"571498c8-908e-40b4-910b-d2369159a3da","title":"Password Protected ZIP File Opened (Email Attachment)","status":"test","level":"high","logsource":{"product":"windows","service":"security"},"data_path":"data/detection-rules/571498c8-908e-40b4-910b-d2369159a3da.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/builtin/security/win_security_susp_opened_encrypted_zip_outlook.yml","author":"Florian Roth (Nextron Systems)","kind":"sigma"},{"id":"f7385ee2-0e0c-11eb-adc1-0242ac120002","title":"Invoke-Obfuscation CLIP+ Launcher - System","status":"test","level":"high","logsource":{"product":"windows","service":"system"},"data_path":"data/detection-rules/f7385ee2-0e0c-11eb-adc1-0242ac120002.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/builtin/system/service_control_manager/win_system_invoke_obfuscation_clip_services.yml","author":"Jonathan Cheong, oscd.community","kind":"sigma"},{"id":"51aa9387-1c53-4153-91cc-d73c59ae1ca9","title":"Invoke-Obfuscation Obfuscated IEX Invocation - System","status":"test","level":"high","logsource":{"product":"windows","service":"system"},"data_path":"data/detection-rules/51aa9387-1c53-4153-91cc-d73c59ae1ca9.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/builtin/system/service_control_manager/win_system_invoke_obfuscation_obfuscated_iex_services.yml","author":"Daniel Bohannon (@Mandiant/@FireEye), oscd.community","kind":"sigma"},{"id":"72862bf2-0eb1-11eb-adc1-0242ac120002","title":"Invoke-Obfuscation STDIN+ Launcher - System","status":"test","level":"high","logsource":{"product":"windows","service":"system"},"data_path":"data/detection-rules/72862bf2-0eb1-11eb-adc1-0242ac120002.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/builtin/system/service_control_manager/win_system_invoke_obfuscation_stdin_services.yml","author":"Jonathan Cheong, oscd.community","kind":"sigma"},{"id":"8ca7004b-e620-4ecb-870e-86129b5b8e75","title":"Invoke-Obfuscation VAR+ Launcher - System","status":"test","level":"high","logsource":{"product":"windows","service":"system"},"data_path":"data/detection-rules/8ca7004b-e620-4ecb-870e-86129b5b8e75.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/builtin/system/service_control_manager/win_system_invoke_obfuscation_var_services.yml","author":"Jonathan Cheong, oscd.community","kind":"sigma"},{"id":"175997c5-803c-4b08-8bb0-70b099f47595","title":"Invoke-Obfuscation COMPRESS OBFUSCATION - System","status":"test","level":"medium","logsource":{"product":"windows","service":"system"},"data_path":"data/detection-rules/175997c5-803c-4b08-8bb0-70b099f47595.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/builtin/system/service_control_manager/win_system_invoke_obfuscation_via_compress_services.yml","author":"Timur Zinniatullin, oscd.community","kind":"sigma"},{"id":"11b52f18-aaec-4d60-9143-5dd8cc4706b9","title":"Invoke-Obfuscation RUNDLL LAUNCHER - System","status":"test","level":"medium","logsource":{"product":"windows","service":"system"},"data_path":"data/detection-rules/11b52f18-aaec-4d60-9143-5dd8cc4706b9.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/builtin/system/service_control_manager/win_system_invoke_obfuscation_via_rundll_services.yml","author":"Timur Zinniatullin, oscd.community","kind":"sigma"},{"id":"487c7524-f892-4054-b263-8a0ace63fc25","title":"Invoke-Obfuscation Via Stdin - System","status":"test","level":"high","logsource":{"product":"windows","service":"system"},"data_path":"data/detection-rules/487c7524-f892-4054-b263-8a0ace63fc25.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/builtin/system/service_control_manager/win_system_invoke_obfuscation_via_stdin_services.yml","author":"Nikita Nazarov, oscd.community","kind":"sigma"},{"id":"63e3365d-4824-42d8-8b82-e56810fefa0c","title":"Invoke-Obfuscation Via Use Clip - System","status":"test","level":"high","logsource":{"product":"windows","service":"system"},"data_path":"data/detection-rules/63e3365d-4824-42d8-8b82-e56810fefa0c.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/builtin/system/service_control_manager/win_system_invoke_obfuscation_via_use_clip_services.yml","author":"Nikita Nazarov, oscd.community","kind":"sigma"},{"id":"7e9c7999-0f9b-4d4a-a6ed-af6d553d4af4","title":"Invoke-Obfuscation Via Use MSHTA - System","status":"test","level":"high","logsource":{"product":"windows","service":"system"},"data_path":"data/detection-rules/7e9c7999-0f9b-4d4a-a6ed-af6d553d4af4.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/builtin/system/service_control_manager/win_system_invoke_obfuscation_via_use_mshta_services.yml","author":"Nikita Nazarov, oscd.community","kind":"sigma"},{"id":"641a4bfb-c017-44f7-800c-2aee0184ce9b","title":"Invoke-Obfuscation Via Use Rundll32 - System","status":"test","level":"high","logsource":{"product":"windows","service":"system"},"data_path":"data/detection-rules/641a4bfb-c017-44f7-800c-2aee0184ce9b.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/builtin/system/service_control_manager/win_system_invoke_obfuscation_via_use_rundll32_services.yml","author":"Nikita Nazarov, oscd.community","kind":"sigma"},{"id":"14bcba49-a428-42d9-b943-e2ce0f0f7ae6","title":"Invoke-Obfuscation VAR++ LAUNCHER OBFUSCATION - System","status":"test","level":"high","logsource":{"product":"windows","service":"system"},"data_path":"data/detection-rules/14bcba49-a428-42d9-b943-e2ce0f0f7ae6.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/builtin/system/service_control_manager/win_system_invoke_obfuscation_via_var_services.yml","author":"Timur Zinniatullin, oscd.community","kind":"sigma"},{"id":"130c9e58-28ac-4f83-8574-0a4cc913b97e","title":"Potential Winnti Dropper Activity","status":"test","level":"high","logsource":{"product":"windows","category":"file_event"},"data_path":"data/detection-rules/130c9e58-28ac-4f83-8574-0a4cc913b97e.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/file/file_event/file_event_win_redmimicry_winnti_filedrop.yml","author":"Alexander Rausch","kind":"sigma"},{"id":"0c3fac91-5627-46e8-a6a8-a0d7b9b8ae1b","title":"Suspicious Get-Variable.exe Creation","status":"test","level":"high","logsource":{"product":"windows","category":"file_event"},"data_path":"data/detection-rules/0c3fac91-5627-46e8-a6a8-a0d7b9b8ae1b.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/file/file_event/file_event_win_susp_get_variable.yml","author":"frack113","kind":"sigma"},{"id":"a136cde0-61ad-4a61-9b82-8dc490e60dd2","title":"Invoke-Obfuscation CLIP+ Launcher - PowerShell Module","status":"test","level":"high","logsource":{"product":"windows","category":"ps_module","definition":"0ad03ef1-f21b-4a79-8ce8-e6900c54b65b"},"data_path":"data/detection-rules/a136cde0-61ad-4a61-9b82-8dc490e60dd2.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/powershell/powershell_module/posh_pm_invoke_obfuscation_clip.yml","author":"Jonathan Cheong, oscd.community","kind":"sigma"},{"id":"2f211361-7dce-442d-b78a-c04039677378","title":"Invoke-Obfuscation Obfuscated IEX Invocation - PowerShell Module","status":"test","level":"high","logsource":{"product":"windows","category":"ps_module","definition":"0ad03ef1-f21b-4a79-8ce8-e6900c54b65b"},"data_path":"data/detection-rules/2f211361-7dce-442d-b78a-c04039677378.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/powershell/powershell_module/posh_pm_invoke_obfuscation_obfuscated_iex.yml","author":"Daniel Bohannon (@Mandiant/@FireEye), oscd.community","kind":"sigma"},{"id":"9ac8b09b-45de-4a07-9da1-0de8c09304a3","title":"Invoke-Obfuscation STDIN+ Launcher - PowerShell Module","status":"test","level":"high","logsource":{"product":"windows","category":"ps_module","definition":"0ad03ef1-f21b-4a79-8ce8-e6900c54b65b"},"data_path":"data/detection-rules/9ac8b09b-45de-4a07-9da1-0de8c09304a3.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/powershell/powershell_module/posh_pm_invoke_obfuscation_stdin.yml","author":"Jonathan Cheong, oscd.community","kind":"sigma"},{"id":"6bfb8fa7-b2e7-4f6c-8d9d-824e5d06ea9e","title":"Invoke-Obfuscation VAR+ Launcher - PowerShell Module","status":"test","level":"high","logsource":{"product":"windows","category":"ps_module","definition":"0ad03ef1-f21b-4a79-8ce8-e6900c54b65b"},"data_path":"data/detection-rules/6bfb8fa7-b2e7-4f6c-8d9d-824e5d06ea9e.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/powershell/powershell_module/posh_pm_invoke_obfuscation_var.yml","author":"Jonathan Cheong, oscd.community","kind":"sigma"},{"id":"7034cbbb-cc55-4dc2-8dad-36c0b942e8f1","title":"Invoke-Obfuscation COMPRESS OBFUSCATION - PowerShell Module","status":"test","level":"medium","logsource":{"product":"windows","category":"ps_module","definition":"0ad03ef1-f21b-4a79-8ce8-e6900c54b65b"},"data_path":"data/detection-rules/7034cbbb-cc55-4dc2-8dad-36c0b942e8f1.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/powershell/powershell_module/posh_pm_invoke_obfuscation_via_compress.yml","author":"Timur Zinniatullin, oscd.community","kind":"sigma"},{"id":"a23791fe-8846-485a-b16b-ca691e1b03d4","title":"Invoke-Obfuscation RUNDLL LAUNCHER - PowerShell Module","status":"test","level":"medium","logsource":{"product":"windows","category":"ps_module","definition":"0ad03ef1-f21b-4a79-8ce8-e6900c54b65b"},"data_path":"data/detection-rules/a23791fe-8846-485a-b16b-ca691e1b03d4.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/powershell/powershell_module/posh_pm_invoke_obfuscation_via_rundll.yml","author":"Timur Zinniatullin, oscd.community","kind":"sigma"},{"id":"c72aca44-8d52-45ad-8f81-f96c4d3c755e","title":"Invoke-Obfuscation Via Stdin - PowerShell Module","status":"test","level":"high","logsource":{"product":"windows","category":"ps_module","definition":"0ad03ef1-f21b-4a79-8ce8-e6900c54b65b"},"data_path":"data/detection-rules/c72aca44-8d52-45ad-8f81-f96c4d3c755e.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/powershell/powershell_module/posh_pm_invoke_obfuscation_via_stdin.yml","author":"Nikita Nazarov, oscd.community","kind":"sigma"},{"id":"ebdf49d8-b89c-46c9-8fdf-2c308406f6bd","title":"Invoke-Obfuscation Via Use Clip - PowerShell Module","status":"test","level":"high","logsource":{"product":"windows","category":"ps_module","definition":"0ad03ef1-f21b-4a79-8ce8-e6900c54b65b"},"data_path":"data/detection-rules/ebdf49d8-b89c-46c9-8fdf-2c308406f6bd.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/powershell/powershell_module/posh_pm_invoke_obfuscation_via_use_clip.yml","author":"Nikita Nazarov, oscd.community","kind":"sigma"},{"id":"07ad2ea8-6a55-4ac6-bf3e-91b8e59676eb","title":"Invoke-Obfuscation Via Use MSHTA - PowerShell Module","status":"test","level":"high","logsource":{"product":"windows","category":"ps_module","definition":"0ad03ef1-f21b-4a79-8ce8-e6900c54b65b"},"data_path":"data/detection-rules/07ad2ea8-6a55-4ac6-bf3e-91b8e59676eb.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/powershell/powershell_module/posh_pm_invoke_obfuscation_via_use_mhsta.yml","author":"Nikita Nazarov, oscd.community","kind":"sigma"},{"id":"88a22f69-62f9-4b8a-aa00-6b0212f2f05a","title":"Invoke-Obfuscation Via Use Rundll32 - PowerShell Module","status":"test","level":"high","logsource":{"product":"windows","category":"ps_module","definition":"0ad03ef1-f21b-4a79-8ce8-e6900c54b65b"},"data_path":"data/detection-rules/88a22f69-62f9-4b8a-aa00-6b0212f2f05a.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/powershell/powershell_module/posh_pm_invoke_obfuscation_via_use_rundll32.yml","author":"Nikita Nazarov, oscd.community","kind":"sigma"},{"id":"f3c89218-8c3d-4ba9-9974-f1d8e6a1b4a6","title":"Invoke-Obfuscation VAR++ LAUNCHER OBFUSCATION - PowerShell Module","status":"test","level":"high","logsource":{"product":"windows","category":"ps_module","definition":"0ad03ef1-f21b-4a79-8ce8-e6900c54b65b"},"data_path":"data/detection-rules/f3c89218-8c3d-4ba9-9974-f1d8e6a1b4a6.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/powershell/powershell_module/posh_pm_invoke_obfuscation_via_var.yml","author":"Timur Zinniatullin, oscd.community","kind":"sigma"},{"id":"73e67340-0d25-11eb-adc1-0242ac120002","title":"Invoke-Obfuscation CLIP+ Launcher - PowerShell","status":"test","level":"high","logsource":{"product":"windows","category":"ps_script","definition":"Requirements: Script Block Logging must be enabled"},"data_path":"data/detection-rules/73e67340-0d25-11eb-adc1-0242ac120002.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/powershell/powershell_script/posh_ps_invoke_obfuscation_clip.yml","author":"Jonathan Cheong, oscd.community","kind":"sigma"},{"id":"1b9dc62e-6e9e-42a3-8990-94d7a10007f7","title":"Invoke-Obfuscation Obfuscated IEX Invocation - PowerShell","status":"test","level":"high","logsource":{"product":"windows","category":"ps_script","definition":"Requirements: Script Block Logging must be enabled"},"data_path":"data/detection-rules/1b9dc62e-6e9e-42a3-8990-94d7a10007f7.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/powershell/powershell_script/posh_ps_invoke_obfuscation_obfuscated_iex.yml","author":"Daniel Bohannon (@Mandiant/@FireEye), oscd.community","kind":"sigma"},{"id":"779c8c12-0eb1-11eb-adc1-0242ac120002","title":"Invoke-Obfuscation STDIN+ Launcher - Powershell","status":"test","level":"high","logsource":{"product":"windows","category":"ps_script","definition":"Requirements: Script Block Logging must be enabled"},"data_path":"data/detection-rules/779c8c12-0eb1-11eb-adc1-0242ac120002.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/powershell/powershell_script/posh_ps_invoke_obfuscation_stdin.yml","author":"Jonathan Cheong, oscd.community","kind":"sigma"},{"id":"0adfbc14-0ed1-11eb-adc1-0242ac120002","title":"Invoke-Obfuscation VAR+ Launcher - PowerShell","status":"test","level":"high","logsource":{"product":"windows","category":"ps_script","definition":"Requirements: Script Block Logging must be enabled"},"data_path":"data/detection-rules/0adfbc14-0ed1-11eb-adc1-0242ac120002.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/powershell/powershell_script/posh_ps_invoke_obfuscation_var.yml","author":"Jonathan Cheong, oscd.community","kind":"sigma"},{"id":"20e5497e-331c-4cd5-8d36-935f6e2a9a07","title":"Invoke-Obfuscation COMPRESS OBFUSCATION - PowerShell","status":"test","level":"medium","logsource":{"product":"windows","category":"ps_script","definition":"Requirements: Script Block Logging must be enabled"},"data_path":"data/detection-rules/20e5497e-331c-4cd5-8d36-935f6e2a9a07.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/powershell/powershell_script/posh_ps_invoke_obfuscation_via_compress.yml","author":"Timur Zinniatullin, oscd.community","kind":"sigma"},{"id":"e6cb92b4-b470-4eb8-8a9d-d63e8583aae0","title":"Invoke-Obfuscation RUNDLL LAUNCHER - PowerShell","status":"test","level":"medium","logsource":{"product":"windows","category":"ps_script","definition":"Requirements: Script Block Logging must be enabled"},"data_path":"data/detection-rules/e6cb92b4-b470-4eb8-8a9d-d63e8583aae0.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/powershell/powershell_script/posh_ps_invoke_obfuscation_via_rundll.yml","author":"Timur Zinniatullin, oscd.community","kind":"sigma"},{"id":"86b896ba-ffa1-4fea-83e3-ee28a4c915c7","title":"Invoke-Obfuscation Via Stdin - Powershell","status":"test","level":"high","logsource":{"product":"windows","category":"ps_script","definition":"Requirements: Script Block Logging must be enabled"},"data_path":"data/detection-rules/86b896ba-ffa1-4fea-83e3-ee28a4c915c7.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/powershell/powershell_script/posh_ps_invoke_obfuscation_via_stdin.yml","author":"Nikita Nazarov, oscd.community","kind":"sigma"},{"id":"db92dd33-a3ad-49cf-8c2c-608c3e30ace0","title":"Invoke-Obfuscation Via Use Clip - Powershell","status":"test","level":"high","logsource":{"product":"windows","category":"ps_script","definition":"Requirements: Script Block Logging must be enabled"},"data_path":"data/detection-rules/db92dd33-a3ad-49cf-8c2c-608c3e30ace0.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/powershell/powershell_script/posh_ps_invoke_obfuscation_via_use_clip.yml","author":"Nikita Nazarov, oscd.community","kind":"sigma"},{"id":"e55a5195-4724-480e-a77e-3ebe64bd3759","title":"Invoke-Obfuscation Via Use MSHTA - PowerShell","status":"test","level":"high","logsource":{"product":"windows","category":"ps_script","definition":"Requirements: Script Block Logging must be enabled"},"data_path":"data/detection-rules/e55a5195-4724-480e-a77e-3ebe64bd3759.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/powershell/powershell_script/posh_ps_invoke_obfuscation_via_use_mhsta.yml","author":"Nikita Nazarov, oscd.community","kind":"sigma"},{"id":"a5a30a6e-75ca-4233-8b8c-42e0f2037d3b","title":"Invoke-Obfuscation Via Use Rundll32 - PowerShell","status":"test","level":"high","logsource":{"product":"windows","category":"ps_script","definition":"Requirements: Script Block Logging must be enabled"},"data_path":"data/detection-rules/a5a30a6e-75ca-4233-8b8c-42e0f2037d3b.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/powershell/powershell_script/posh_ps_invoke_obfuscation_via_use_rundll32.yml","author":"Nikita Nazarov, oscd.community","kind":"sigma"},{"id":"e54f5149-6ba3-49cf-b153-070d24679126","title":"Invoke-Obfuscation VAR++ LAUNCHER OBFUSCATION - PowerShell","status":"test","level":"high","logsource":{"product":"windows","category":"ps_script","definition":"Requirements: Script Block Logging must be enabled"},"data_path":"data/detection-rules/e54f5149-6ba3-49cf-b153-070d24679126.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/powershell/powershell_script/posh_ps_invoke_obfuscation_via_var.yml","author":"Timur Zinniatullin, oscd.community","kind":"sigma"},{"id":"e8314f79-564d-4f79-bc13-fbc0bf2660d8","title":"Potential PowerShell Obfuscation Using Character Join","status":"test","level":"low","logsource":{"product":"windows","category":"ps_script","definition":"Requirements: Script Block Logging must be enabled"},"data_path":"data/detection-rules/e8314f79-564d-4f79-bc13-fbc0bf2660d8.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/powershell/powershell_script/posh_ps_susp_alias_obfscuation.yml","author":"Nasreddine Bencherchali (Nextron Systems)","kind":"sigma"},{"id":"96cd126d-f970-49c4-848a-da3a09f55c55","title":"Potential PowerShell Obfuscation Using Alias Cmdlets","status":"test","level":"low","logsource":{"product":"windows","category":"ps_script","definition":"Requirements: Script Block Logging must be enabled"},"data_path":"data/detection-rules/96cd126d-f970-49c4-848a-da3a09f55c55.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/powershell/powershell_script/posh_ps_susp_set_alias.yml","author":"frack113","kind":"sigma"},{"id":"cc9cbe82-7bc0-4ef5-bc23-bbfb83947be7","title":"File Decoded From Base64/Hex Via Certutil.EXE","status":"test","level":"high","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/cc9cbe82-7bc0-4ef5-bc23-bbfb83947be7.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_certutil_decode.yml","author":"Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community","kind":"sigma"},{"id":"19b08b1c-861d-4e75-a1ef-ea0c1baf202b","title":"Suspicious Download Via Certutil.EXE","status":"test","level":"medium","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/19b08b1c-861d-4e75-a1ef-ea0c1baf202b.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_certutil_download.yml","author":"Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community, Nasreddine Bencherchali (Nextron Systems)","kind":"sigma"},{"id":"13e6fe51-d478-4c7e-b0f2-6da9b400a829","title":"Suspicious File Downloaded From Direct IP Via Certutil.EXE","status":"test","level":"high","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/13e6fe51-d478-4c7e-b0f2-6da9b400a829.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_certutil_download_direct_ip.yml","author":"Nasreddine Bencherchali (Nextron Systems)","kind":"sigma"},{"id":"42a5f1e7-9603-4f6d-97ae-3f37d130d794","title":"Suspicious File Downloaded From File-Sharing Website Via Certutil.EXE","status":"test","level":"high","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/42a5f1e7-9603-4f6d-97ae-3f37d130d794.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_certutil_download_file_sharing_domains.yml","author":"Nasreddine Bencherchali (Nextron Systems)","kind":"sigma"},{"id":"e62a9f0c-ca1e-46b2-85d5-a6da77f86d1a","title":"File Encoded To Base64 Via Certutil.EXE","status":"test","level":"medium","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/e62a9f0c-ca1e-46b2-85d5-a6da77f86d1a.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_certutil_encode.yml","author":"Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community, Nasreddine Bencherchali (Nextron Systems)","kind":"sigma"},{"id":"ea0cdc3e-2239-4f26-a947-4e8f8224e464","title":"Suspicious File Encoded To Base64 Via Certutil.EXE","status":"test","level":"high","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/ea0cdc3e-2239-4f26-a947-4e8f8224e464.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_certutil_encode_susp_extensions.yml","author":"Nasreddine Bencherchali (Nextron Systems)","kind":"sigma"},{"id":"82a6714f-4899-4f16-9c1e-9a333544d4c3","title":"File In Suspicious Location Encoded To Base64 Via Certutil.EXE","status":"test","level":"high","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/82a6714f-4899-4f16-9c1e-9a333544d4c3.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_certutil_encode_susp_location.yml","author":"Nasreddine Bencherchali (Nextron Systems)","kind":"sigma"},{"id":"3ffd6f51-e6c1-47b7-94b4-c1e61d4117c5","title":"Certificate Exported Via Certutil.EXE","status":"test","level":"medium","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/3ffd6f51-e6c1-47b7-94b4-c1e61d4117c5.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_certutil_export_pfx.yml","author":"Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community, Nasreddine Bencherchali (Nextron Systems)","kind":"sigma"},{"id":"b222df08-0e07-11eb-adc1-0242ac120002","title":"Invoke-Obfuscation CLIP+ Launcher","status":"test","level":"high","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/b222df08-0e07-11eb-adc1-0242ac120002.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_hktl_invoke_obfuscation_clip.yml","author":"Jonathan Cheong, oscd.community","kind":"sigma"},{"id":"4bf943c6-5146-4273-98dd-e958fd1e3abf","title":"Invoke-Obfuscation Obfuscated IEX Invocation","status":"test","level":"high","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/4bf943c6-5146-4273-98dd-e958fd1e3abf.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_hktl_invoke_obfuscation_obfuscated_iex_commandline.yml","author":"Daniel Bohannon (@Mandiant/@FireEye), oscd.community","kind":"sigma"},{"id":"6c96fc76-0eb1-11eb-adc1-0242ac120002","title":"Invoke-Obfuscation STDIN+ Launcher","status":"test","level":"high","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/6c96fc76-0eb1-11eb-adc1-0242ac120002.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_hktl_invoke_obfuscation_stdin.yml","author":"Jonathan Cheong, oscd.community","kind":"sigma"},{"id":"27aec9c9-dbb0-4939-8422-1742242471d0","title":"Invoke-Obfuscation VAR+ Launcher","status":"test","level":"high","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/27aec9c9-dbb0-4939-8422-1742242471d0.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_hktl_invoke_obfuscation_var.yml","author":"Jonathan Cheong, oscd.community","kind":"sigma"},{"id":"7eedcc9d-9fdb-4d94-9c54-474e8affc0c7","title":"Invoke-Obfuscation COMPRESS OBFUSCATION","status":"test","level":"medium","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/7eedcc9d-9fdb-4d94-9c54-474e8affc0c7.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_hktl_invoke_obfuscation_via_compress.yml","author":"Timur Zinniatullin, oscd.community","kind":"sigma"},{"id":"9c14c9fa-1a63-4a64-8e57-d19280559490","title":"Invoke-Obfuscation Via Stdin","status":"test","level":"high","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/9c14c9fa-1a63-4a64-8e57-d19280559490.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_hktl_invoke_obfuscation_via_stdin.yml","author":"Nikita Nazarov, oscd.community","kind":"sigma"},{"id":"e1561947-b4e3-4a74-9bdd-83baed21bdb5","title":"Invoke-Obfuscation Via Use Clip","status":"test","level":"high","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/e1561947-b4e3-4a74-9bdd-83baed21bdb5.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_hktl_invoke_obfuscation_via_use_clip.yml","author":"Nikita Nazarov, oscd.community","kind":"sigma"},{"id":"ac20ae82-8758-4f38-958e-b44a3140ca88","title":"Invoke-Obfuscation Via Use MSHTA","status":"test","level":"high","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/ac20ae82-8758-4f38-958e-b44a3140ca88.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_hktl_invoke_obfuscation_via_use_mhsta.yml","author":"Nikita Nazarov, oscd.community","kind":"sigma"},{"id":"e9f55347-2928-4c06-88e5-1a7f8169942e","title":"Invoke-Obfuscation VAR++ LAUNCHER OBFUSCATION","status":"test","level":"high","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/e9f55347-2928-4c06-88e5-1a7f8169942e.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_hktl_invoke_obfuscation_via_var.yml","author":"Timur Zinniatullin, oscd.community","kind":"sigma"},{"id":"1a0d4aba-7668-4365-9ce4-6d79ab088dfd","title":"Ping Hex IP","status":"test","level":"high","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/1a0d4aba-7668-4365-9ce4-6d79ab088dfd.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_ping_hex_ip.yml","author":"Florian Roth (Nextron Systems)","kind":"sigma"},{"id":"6385697e-9f1b-40bd-8817-f4a91f40508e","title":"PowerShell Base64 Encoded Invoke Keyword","status":"test","level":"high","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/6385697e-9f1b-40bd-8817-f4a91f40508e.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_powershell_base64_invoke.yml","author":"pH-T (Nextron Systems), Harjot Singh, @cyb3rjy0t","kind":"sigma"},{"id":"62b7ccc9-23b4-471e-aa15-6da3663c4d59","title":"PowerShell Base64 Encoded Reflective Assembly Load","status":"test","level":"high","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/62b7ccc9-23b4-471e-aa15-6da3663c4d59.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_powershell_base64_reflection_assembly_load.yml","author":"Christian Burkard (Nextron Systems), pH-T (Nextron Systems)","kind":"sigma"},{"id":"9c0295ce-d60d-40bd-bd74-84673b7592b1","title":"Suspicious Encoded And Obfuscated Reflection Assembly Load Function Call","status":"test","level":"high","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/9c0295ce-d60d-40bd-bd74-84673b7592b1.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_powershell_base64_reflection_assembly_load_obfusc.yml","author":"pH-T (Nextron Systems)","kind":"sigma"},{"id":"1816994b-42e1-4fb1-afd2-134d88184f71","title":"PowerShell Base64 Encoded WMI Classes","status":"test","level":"high","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/1816994b-42e1-4fb1-afd2-134d88184f71.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_powershell_base64_wmi_classes.yml","author":"Christian Burkard (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)","kind":"sigma"},{"id":"74403157-20f5-415d-89a7-c505779585cf","title":"ConvertTo-SecureString Cmdlet Usage Via CommandLine","status":"test","level":"medium","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/74403157-20f5-415d-89a7-c505779585cf.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_powershell_cmdline_convertto_securestring.yml","author":"Teymur Kheirkhabarov (idea), Vasiliy Burov (rule), oscd.community, Tim Shelton","kind":"sigma"},{"id":"b6b49cd1-34d6-4ead-b1bf-176e9edba9a4","title":"Potential PowerShell Obfuscation Via Reversed Commands","status":"test","level":"high","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/b6b49cd1-34d6-4ead-b1bf-176e9edba9a4.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_powershell_cmdline_reversed_strings.yml","author":"Teymur Kheirkhabarov (idea), Vasiliy Burov (rule), oscd.community, Tim Shelton","kind":"sigma"},{"id":"d7bcd677-645d-4691-a8d4-7a5602b780d1","title":"Potential PowerShell Command Line Obfuscation","status":"test","level":"high","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/d7bcd677-645d-4691-a8d4-7a5602b780d1.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_powershell_cmdline_special_characters.yml","author":"Teymur Kheirkhabarov (idea), Vasiliy Burov (rule), oscd.community, Tim Shelton (fp)","kind":"sigma"},{"id":"cdf05894-89e7-4ead-b2b0-0a5f97a90f2f","title":"Potential Encoded PowerShell Patterns In CommandLine","status":"test","level":"low","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/cdf05894-89e7-4ead-b2b0-0a5f97a90f2f.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_powershell_encoding_patterns.yml","author":"Teymur Kheirkhabarov (idea), Vasiliy Burov (rule), oscd.community, Tim Shelton","kind":"sigma"},{"id":"e32d4572-9826-4738-b651-95fa63747e8a","title":"Base64 Encoded PowerShell Command Detected","status":"test","level":"high","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/e32d4572-9826-4738-b651-95fa63747e8a.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_powershell_frombase64string.yml","author":"Florian Roth (Nextron Systems)","kind":"sigma"},{"id":"e312efd0-35a1-407f-8439-b8d434b438a6","title":"Potential PowerShell Obfuscation Via WCHAR/CHAR","status":"test","level":"high","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/e312efd0-35a1-407f-8439-b8d434b438a6.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_powershell_obfuscation_via_utf8.yml","author":"Florian Roth (Nextron Systems)","kind":"sigma"},{"id":"bb780e0c-16cf-4383-8383-1e5471db6cf9","title":"Suspicious XOR Encoded PowerShell Command","status":"test","level":"medium","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/bb780e0c-16cf-4383-8383-1e5471db6cf9.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_powershell_xor_commandline.yml","author":"Sami Ruohonen, Harish Segar, Tim Shelton, Teymur Kheirkhabarov, Vasiliy Burov, oscd.community, Nasreddine Bencherchali","kind":"sigma"},{"id":"0c92f2e6-f08f-4b73-9216-ecb0ca634689","title":"PUA - Potential PE Metadata Tamper Using Rcedit","status":"test","level":"medium","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/0c92f2e6-f08f-4b73-9216-ecb0ca634689.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_pua_rcedit_execution.yml","author":"Micah Babinski","kind":"sigma"},{"id":"f4264e47-f522-4c38-a420-04525d5b880f","title":"Renamed AutoIt Execution","status":"test","level":"high","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/f4264e47-f522-4c38-a420-04525d5b880f.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_renamed_autoit.yml","author":"Florian Roth (Nextron Systems)","kind":"sigma"},{"id":"584bca0f-3608-4402-80fd-4075ff6072e3","title":"Potential CommandLine Obfuscation Using Unicode Characters From Suspicious Image","status":"test","level":"high","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/584bca0f-3608-4402-80fd-4075ff6072e3.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_susp_cli_obfuscation_unicode_img.yml","author":"frack113, Florian Roth (Nextron Systems), Josh Nickels","kind":"sigma"},{"id":"2617e7ed-adb7-40ba-b0f3-8f9945fe6c09","title":"Suspicious SYSTEM User Process Creation","status":"test","level":"high","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/2617e7ed-adb7-40ba-b0f3-8f9945fe6c09.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_susp_system_user_anomaly.yml","author":"Florian Roth (Nextron Systems), David ANDRE (additional keywords)","kind":"sigma"}],"atlas_basic":[{"id":"atlas-basic-t1027-1","technique_id":"T1027","title":"T1027 Obfuscated Files or Information","kind":"basic","source_url":"https://1200km.com/anomaly-detection-atlas/attack-basic-detection-rule-catalog/#defense-evasion","source_path":"docs/attack-basic-detection-rule-catalog.md","source_line":97,"pinned_source_url":"https://github.com/anpa1200/anomaly-detection-atlas/blob/e1f75007376022b2f596e413bea8612e514a5aa3/docs/attack-basic-detection-rule-catalog.md#L97","source_file_sha256":"396a87e3d8da74d170684c0f377fe5dc11cd1a486d4f2f89f7fbe94deaaa2a1e","source_row_sha256":"ff3dfa3ea42c55fa1e8a236060e5c1207e90e32e52ff224a6e382ac026188dcc","validation":"published_concept_not_executable_or_live_validated","logic":"MATCH(command_line_contains_encoding_flags OR script_matches_obfuscation_signature OR file_packer_signature) -> ALERT","log_sources":[{"title":"Script-Execution Logs","url":"https://1200km.com/anomaly-detection-atlas/security-log-source-taxonomy/#8-script-execution-logs"},{"title":"Content Inspection and Malware Scanning Logs","url":"https://1200km.com/anomaly-detection-atlas/security-log-source-taxonomy/#101-content-inspection-and-malware-scanning-logs"},{"title":"Sandbox Analysis Logs","url":"https://1200km.com/anomaly-detection-atlas/security-log-source-taxonomy/#141-sandbox-analysis-logs"}]}],"atlas_anomaly":[{"id":"atlas-anomaly-t1027-1","technique_id":"T1027","title":"Encoded, packed, or obfuscated content — T1027 Obfuscated Files or Information","kind":"anomaly","source_url":"https://1200km.com/anomaly-detection-atlas/attack-statistical-anomaly-mapping/#obfuscated-content","source_path":"docs/attack-statistical-anomaly-mapping.md","source_line":67,"pinned_source_url":"https://github.com/anpa1200/anomaly-detection-atlas/blob/e1f75007376022b2f596e413bea8612e514a5aa3/docs/attack-statistical-anomaly-mapping.md#L67","source_file_sha256":"9d38eaa6306863918e8193f267fb063270260e50b013928dc97893d5e74bf144","source_row_sha256":"17b328ea3321bfc229fbdb344f9ae1f019876c0c4c8f273b1354a0105f539272","validation":"published_concept_not_executable_or_live_validated","comparison_unit":"content or command representation.","expected_behavior":"ordinary content has stable length, entropy, token, and character distributions.","deviation":"extreme entropy, rare token composition, or distribution shift.","anomaly_types":[{"title":"Tail Anomaly","url":"https://1200km.com/anomaly-detection-atlas/statistical-anomaly-taxonomy/#41-tail-anomaly"},{"title":"Entropy Anomaly","url":"https://1200km.com/anomaly-detection-atlas/statistical-anomaly-taxonomy/#43-entropy-anomaly"},{"title":"Distribution-Shift Anomaly","url":"https://1200km.com/anomaly-detection-atlas/statistical-anomaly-taxonomy/#34-distribution-shift-anomaly"}],"log_sources":[{"title":"Script-Execution Logs","url":"https://1200km.com/anomaly-detection-atlas/security-log-source-taxonomy/#8-script-execution-logs"},{"title":"Content Inspection and Malware Scanning Logs","url":"https://1200km.com/anomaly-detection-atlas/security-log-source-taxonomy/#101-content-inspection-and-malware-scanning-logs"}],"context_references":[{"title":"Mandiant SUNBURST investigation — downloaded copy","url":"https://1200km.com/anomaly-detection-atlas/reports/cti-ir/mandiant-sunburst-supply-chain.html"},{"title":"original source","url":"https://cloud.google.com/blog/topics/threat-intelligence/evasive-attacker-leverages-solarwinds-supply-chain-compromises-with-sunburst-backdoor/"}]}],"anomaly_types":[{"title":"Distribution-Shift Anomaly","url":"https://1200km.com/anomaly-detection-atlas/statistical-anomaly-taxonomy/#34-distribution-shift-anomaly"},{"title":"Entropy Anomaly","url":"https://1200km.com/anomaly-detection-atlas/statistical-anomaly-taxonomy/#43-entropy-anomaly"},{"title":"Tail Anomaly","url":"https://1200km.com/anomaly-detection-atlas/statistical-anomaly-taxonomy/#41-tail-anomaly"}],"strategies":[{"id":"DET0378","name":"Behavioral Detection of Obfuscated Files or Information","url":"https://attack.mitre.org/detectionstrategies/DET0378","stix_id":"x-mitre-detection-strategy--e3758cbb-5dd9-4aad-b848-0539a8c56307","relationship_id":"relationship--f1b0ce50-319c-455f-a8b2-a90f32310364","description":"","analytics":[{"id":"AN1064","name":"Analytic 1064","guidance":"Correlates script execution or suspicious parent processes with creation or modification of encoded, compressed, or encrypted file formats (e.g., .zip, .7z, .enc) and abnormal command-line syntax or PowerShell obfuscation.","url":"https://attack.mitre.org/detectionstrategies/DET0378#AN1064","platforms":["Windows"],"tuning":[{"field":"PayloadEntropyThreshold","description":"Tune entropy threshold to distinguish obfuscation from legitimate compression"},{"field":"TimeWindow","description":"Adjust correlation window between script execution and encoded file creation"},{"field":"SuspiciousParentProcessList","description":"Customize based on environment to include LOLBins or admin tools misused for obfuscation"}],"log_sources":[{"component_id":"DC0032","component":"Process Creation","name":"WinEventLog:Security","channel":"EventCode=4688","platforms":["Windows"],"analytic_id":"AN1064","source_url":"https://attack.mitre.org/detectionstrategies/DET0378#AN1064","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0032/"},{"component_id":"DC0039","component":"File Creation","name":"WinEventLog:Sysmon","channel":"EventCode=11","platforms":["Windows"],"analytic_id":"AN1064","source_url":"https://attack.mitre.org/detectionstrategies/DET0378#AN1064","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0039/"},{"component_id":"DC0032","component":"Process Creation","name":"WinEventLog:Sysmon","channel":"EventCode=1","platforms":["Windows"],"analytic_id":"AN1064","source_url":"https://attack.mitre.org/detectionstrategies/DET0378#AN1064","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0032/"}]},{"id":"AN1065","name":"Analytic 1065","guidance":"Detects use of gzip, base64, tar, or openssl in scripts or commands that encode/encrypt files after file staging or system enumeration.","url":"https://attack.mitre.org/detectionstrategies/DET0378#AN1065","platforms":["Linux"],"tuning":[{"field":"CommandRegex","description":"Customize for tools seen in environment (e.g., gzip, bzip2, xz)"},{"field":"SensitivePathList","description":"Specify file paths likely targeted for obfuscation (e.g., /etc/, /home/)"}],"log_sources":[{"component_id":"DC0032","component":"Process Creation","name":"auditd:SYSCALL","channel":"execve","platforms":["Linux"],"analytic_id":"AN1065","source_url":"https://attack.mitre.org/detectionstrategies/DET0378#AN1065","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0032/"},{"component_id":"DC0061","component":"File Modification","name":"auditd:SYSCALL","channel":"open, write","platforms":["Linux"],"analytic_id":"AN1065","source_url":"https://attack.mitre.org/detectionstrategies/DET0378#AN1065","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0061/"},{"component_id":"DC0064","component":"Command Execution","name":"linux:cli","channel":"Shell history logs","platforms":["Linux"],"analytic_id":"AN1065","source_url":"https://attack.mitre.org/detectionstrategies/DET0378#AN1065","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0064/"}]},{"id":"AN1066","name":"Analytic 1066","guidance":"Monitors use of archive or encryption tools (zip, openssl) tied to user-scripted activity or binaries writing encoded payloads under /Users or /Volumes.","url":"https://attack.mitre.org/detectionstrategies/DET0378#AN1066","platforms":["macOS"],"tuning":[{"field":"FilenameExtensionList","description":"Tunable to identify uncommon or encrypted file formats (e.g., .enc, .b64, .xz)"},{"field":"UserContext","description":"Tune to prioritize unexpected file access by service accounts"}],"log_sources":[{"component_id":"DC0064","component":"Command Execution","name":"macos:unifiedlog","channel":"log stream --predicate 'processImagePath contains \"zip\" OR \"base64\"'","platforms":["macOS"],"analytic_id":"AN1066","source_url":"https://attack.mitre.org/detectionstrategies/DET0378#AN1066","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0064/"},{"component_id":"DC0039","component":"File Creation","name":"macos:osquery","channel":"file_events","platforms":["macOS"],"analytic_id":"AN1066","source_url":"https://attack.mitre.org/detectionstrategies/DET0378#AN1066","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0039/"}]},{"id":"AN1067","name":"Analytic 1067","guidance":"Identifies transfer of base64, uuencoded, or high-entropy files over HTTP, FTP, or custom protocols in lateral movement or exfiltration streams.","url":"https://attack.mitre.org/detectionstrategies/DET0378#AN1067","platforms":["Network Devices"],"tuning":[{"field":"EntropyThreshold","description":"Adjust threshold to reduce false positives in compressed but benign data"},{"field":"ProtocolScope","description":"Refine by enabling inspection of specific exfil vectors (e.g., FTP, HTTP POST)"}],"log_sources":[{"component_id":"DC0085","component":"Network Traffic Content","name":"networkdevice:IDS","channel":"content inspection / PCAP / HTTP body","platforms":["Network Devices"],"analytic_id":"AN1067","source_url":"https://attack.mitre.org/detectionstrategies/DET0378#AN1067","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0085/"}]},{"id":"AN1068","name":"Analytic 1068","guidance":"Detects encoded PowerCLI or Base64-encoded payloads staged via datastore uploads or shell access (e.g., ESXi Shell or backdoored VIBs).","url":"https://attack.mitre.org/detectionstrategies/DET0378#AN1068","platforms":["ESXi"],"tuning":[{"field":"StagingLocation","description":"Tune based on observed adversary paths (e.g., /vmfs/volumes/...)"},{"field":"EncodedLengthThreshold","description":"Tune length of encoded payloads before triggering detection"}],"log_sources":[{"component_id":"DC0059","component":"File Metadata","name":"esxi:vmkernel","channel":"Datastore modification events","platforms":["ESXi"],"analytic_id":"AN1068","source_url":"https://attack.mitre.org/detectionstrategies/DET0378#AN1068","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0059/"},{"component_id":"DC0021","component":"OS API Execution","name":"esxi:hostd","channel":"Remote access API calls and file uploads","platforms":["ESXi"],"analytic_id":"AN1068","source_url":"https://attack.mitre.org/detectionstrategies/DET0378#AN1068","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0021/"}]}]}],"telemetry_references":[{"id":"DC0064","name":"Command Execution","tag":"Command Execution","page":"telemetry/DC0064/","kind":"attack_component"},{"id":"DC0039","name":"File Creation","tag":"File Creation","page":"telemetry/DC0039/","kind":"attack_component"},{"id":"DC0059","name":"File Metadata","tag":"File Metadata","page":"telemetry/DC0059/","kind":"attack_component"},{"id":"DC0061","name":"File Modification","tag":"File Modification","page":"telemetry/DC0061/","kind":"attack_component"},{"id":"DC0085","name":"Network Traffic Content","tag":"Network Traffic Content","page":"telemetry/DC0085/","kind":"attack_component"},{"id":"DC0021","name":"OS API Execution","tag":"OS API Execution","page":"telemetry/DC0021/","kind":"attack_component"},{"id":"DC0032","name":"Process Creation","tag":"Process Creation","page":"telemetry/DC0032/","kind":"attack_component"}],"visibility":"source_mapped","visibility_note":null,"tool_references":[{"id":"S1063","name":"Brute Ratel C4","page":"tools/S1063/","kind":"attack_tool","bases":["attack_uses"],"guides":[]},{"id":"S0465","name":"CARROTBALL","page":"tools/S0465/","kind":"attack_tool","bases":["attack_uses"],"guides":[]},{"id":"S0154","name":"Cobalt Strike","page":"tools/S0154/","kind":"selected_framework","bases":["attack_uses"],"guides":[]},{"id":"S0434","name":"Imminent Monitor","page":"tools/S0434/","kind":"attack_tool","bases":["attack_uses"],"guides":[]},{"id":"S0500","name":"MCMD","page":"tools/S0500/","kind":"attack_tool","bases":["attack_uses"],"guides":[]},{"id":"S0594","name":"Out1","page":"tools/S0594/","kind":"attack_tool","bases":["attack_uses"],"guides":[]},{"id":"S0332","name":"Remcos","page":"tools/S0332/","kind":"attack_tool","bases":["attack_uses"],"guides":[]},{"id":"S0445","name":"ShimRatReporter","page":"tools/S0445/","kind":"attack_tool","bases":["attack_uses"],"guides":[]},{"id":"S0633","name":"Sliver","page":"tools/S0633/","kind":"attack_tool","bases":["attack_uses"],"guides":[{"id":"38602f432e5c","title":"Lab Architecture — Operation DragonRx","published_at":"2026-05-02","url":"https://1200km.com/articles/read/2026/2026-05-02-lab-architecture-operation-dragonrx-38602f432e5c/","original_url":"https://medium.com/@1200km/lab-architecture-operation-dragonrx-38602f432e5c","archive_path":"docs/articles/2026/2026-05-02-lab-architecture-operation-dragonrx-38602f432e5c.md","source_sha256":"51e18974e1481d1b83f58c3bff3a997c21e58fd027e2a159389ace500f2bc289","tool_ids":["S0633"]},{"id":"91339316f0df","title":"Attack Playbook — Operation DragonRx","published_at":"2026-05-04","url":"https://1200km.com/articles/read/2026/2026-05-04-attack-playbook-operation-dragonrx-91339316f0df/","original_url":"https://medium.com/@1200km/attack-playbook-operation-dragonrx-91339316f0df","archive_path":"docs/articles/2026/2026-05-04-attack-playbook-operation-dragonrx-91339316f0df.md","source_sha256":"9b81bd1fd3daa8174dfb523b4b050f4710e62a9ce176029571975b56f6d246a0","tool_ids":["S0633"]}]}],"related_parent":null,"article_url":"https://1200km.com/articles/read/2026/2026-04-20-malicious-activity-as-a-statistical-signal-a-detection-engineering-analysis-of-anomaly-bas-90df8b6dea12/","validation":{"source_join":"exact_ids","sigma_yaml":"parsed","backend_compilation":"not_run","live_telemetry":"not_run","detection_execution":"not_run"}},"tools":[{"id":"S1063","name":"Brute Ratel C4","page":"tools/S1063/","kind":"attack_tool","bases":["attack_uses"],"guides":[]},{"id":"S0465","name":"CARROTBALL","page":"tools/S0465/","kind":"attack_tool","bases":["attack_uses"],"guides":[]},{"id":"S0154","name":"Cobalt Strike","page":"tools/S0154/","kind":"selected_framework","bases":["attack_uses"],"guides":[]},{"id":"S0434","name":"Imminent Monitor","page":"tools/S0434/","kind":"attack_tool","bases":["attack_uses"],"guides":[]},{"id":"S0500","name":"MCMD","page":"tools/S0500/","kind":"attack_tool","bases":["attack_uses"],"guides":[]},{"id":"S0594","name":"Out1","page":"tools/S0594/","kind":"attack_tool","bases":["attack_uses"],"guides":[]},{"id":"S0332","name":"Remcos","page":"tools/S0332/","kind":"attack_tool","bases":["attack_uses"],"guides":[]},{"id":"S0445","name":"ShimRatReporter","page":"tools/S0445/","kind":"attack_tool","bases":["attack_uses"],"guides":[]},{"id":"S0633","name":"Sliver","page":"tools/S0633/","kind":"attack_tool","bases":["attack_uses"],"guides":[{"id":"38602f432e5c","title":"Lab Architecture — Operation DragonRx","published_at":"2026-05-02","url":"https://1200km.com/articles/read/2026/2026-05-02-lab-architecture-operation-dragonrx-38602f432e5c/","original_url":"https://medium.com/@1200km/lab-architecture-operation-dragonrx-38602f432e5c","archive_path":"docs/articles/2026/2026-05-02-lab-architecture-operation-dragonrx-38602f432e5c.md","source_sha256":"51e18974e1481d1b83f58c3bff3a997c21e58fd027e2a159389ace500f2bc289","tool_ids":["S0633"]},{"id":"91339316f0df","title":"Attack Playbook — Operation DragonRx","published_at":"2026-05-04","url":"https://1200km.com/articles/read/2026/2026-05-04-attack-playbook-operation-dragonrx-91339316f0df/","original_url":"https://medium.com/@1200km/attack-playbook-operation-dragonrx-91339316f0df","archive_path":"docs/articles/2026/2026-05-04-attack-playbook-operation-dragonrx-91339316f0df.md","source_sha256":"9b81bd1fd3daa8174dfb523b4b050f4710e62a9ce176029571975b56f6d246a0","tool_ids":["S0633"]}]}],"software":[{"id":"S0012","name":"PoisonIvy","url":"https://attack.mitre.org/software/S0012","kind":"malware","description":"[PoisonIvy](https://attack.mitre.org/software/S0012) hides any strings related to its own indicators of compromise.(Citation: Symantec Darkmoon Aug 2005)","relationship_id":"relationship--27f8b192-9e86-49dc-abca-5bda3f8f7e89","references":[{"source_name":"Symantec Darkmoon Aug 2005","description":"Hayashi, K. (2005, August 18). Backdoor.Darkmoon. Retrieved February 23, 2018.","url":"https://www.symantec.com/security_response/writeup.jsp?docid=2005-081910-3934-99"}]},{"id":"S0013","name":"PlugX","url":"https://attack.mitre.org/software/S0013","kind":"malware","description":"[PlugX](https://attack.mitre.org/software/S0013) can use API hashing and modify the names of strings to evade detection.(Citation: Trend Micro DRBControl February 2020)(Citation: Proofpoint TA416 Europe March 2022)","relationship_id":"relationship--e809f78f-344d-4169-a145-89023f4530d5","references":[{"source_name":"Trend Micro DRBControl February 2020","description":"Lunghi, D. et al. (2020, February). Uncovering DRBControl. Retrieved November 12, 2021.","url":"https://documents.trendmicro.com/assets/white_papers/wp-uncovering-DRBcontrol.pdf"},{"source_name":"Proofpoint TA416 Europe March 2022","description":"Raggi, M. et al. (2022, March 7). The Good, the Bad, and the Web Bug: TA416 Increases Operational Tempo Against European Governments as Conflict in Ukraine Escalates. Retrieved March 16, 2022.","url":"https://www.proofpoint.com/us/blog/threat-insight/good-bad-and-web-bug-ta416-increases-operational-tempo-against-european"}]},{"id":"S0030","name":"Carbanak","url":"https://attack.mitre.org/software/S0030","kind":"malware","description":"[Carbanak](https://attack.mitre.org/software/S0030) encrypts strings to make analysis more difficult.(Citation: FireEye CARBANAK June 2017)","relationship_id":"relationship--7c3f8d37-e2da-45c3-8ef2-a067cd46d340","references":[{"source_name":"FireEye CARBANAK June 2017","description":"Bennett, J., Vengerik, B. (2017, June 12). Behind the CARBANAK Backdoor. Retrieved June 11, 2018.","url":"https://www.fireeye.com/blog/threat-research/2017/06/behind-the-carbanak-backdoor.html"}]},{"id":"S0045","name":"ADVSTORESHELL","url":"https://attack.mitre.org/software/S0045","kind":"malware","description":"Most of the strings in [ADVSTORESHELL](https://attack.mitre.org/software/S0045) are encrypted with an XOR-based algorithm; some strings are also encrypted with 3DES and reversed. API function names are also reversed, presumably to avoid detection in memory.(Citation: Kaspersky Sofacy)(Citation: Bitdefender APT28 Dec 2015)","relationship_id":"relationship--b6fc7740-4e5f-4f4c-8b1e-d0e3368eee03","references":[{"source_name":"Kaspersky Sofacy","description":"Kaspersky Lab's Global Research and Analysis Team. (2015, December 4). Sofacy APT hits high profile targets with updated toolset. Retrieved December 10, 2015.","url":"https://securelist.com/sofacy-apt-hits-high-profile-targets-with-updated-toolset/72924/"},{"source_name":"Bitdefender APT28 Dec 2015","description":"Bitdefender. (2015, December). APT28 Under the Scope. Retrieved February 23, 2017.","url":"https://download.bitdefender.com/resources/media/materials/white-papers/en/Bitdefender_In-depth_analysis_of_APT28%E2%80%93The_Political_Cyber-Espionage.pdf"}]},{"id":"S0051","name":"MiniDuke","url":"https://attack.mitre.org/software/S0051","kind":"malware","description":"[MiniDuke](https://attack.mitre.org/software/S0051) can use control flow flattening to obscure code.(Citation: ESET Dukes October 2019)","relationship_id":"relationship--569815f7-4a3f-47f3-8903-0b0b2d409c3c","references":[{"source_name":"ESET Dukes October 2019","description":"Faou, M., Tartare, M., Dupuy, T. (2019, October). OPERATION GHOST. Retrieved September 23, 2020.","url":"https://www.welivesecurity.com/wp-content/uploads/2019/10/ESET_Operation_Ghost_Dukes.pdf"}]},{"id":"S0062","name":"DustySky","url":"https://attack.mitre.org/software/S0062","kind":"malware","description":"The [DustySky](https://attack.mitre.org/software/S0062) dropper uses a function to obfuscate the name of functions and other parts of the malware.(Citation: DustySky)","relationship_id":"relationship--40772ec1-2f25-425f-aad5-635f64ba8fd2","references":[{"source_name":"DustySky","description":"ClearSky. (2016, January 7). Operation DustySky. Retrieved January 8, 2016.","url":"https://www.clearskysec.com/wp-content/uploads/2016/01/Operation%20DustySky_TLP_WHITE.pdf"}]},{"id":"S0063","name":"SHOTPUT","url":"https://attack.mitre.org/software/S0063","kind":"malware","description":"[SHOTPUT](https://attack.mitre.org/software/S0063) is obscured using XOR encoding and appended to a valid GIF file.(Citation: FireEye Clandestine Wolf)(Citation: Palo Alto CVE-2015-3113 July 2015)","relationship_id":"relationship--315aab88-9b01-4a70-8f8c-173a3f29e79c","references":[{"source_name":"FireEye Clandestine Wolf","description":"Eng, E., Caselden, D.. (2015, June 23). Operation Clandestine Wolf – Adobe Flash Zero-Day in APT3 Phishing Campaign. Retrieved January 14, 2016.","url":"https://www.fireeye.com/blog/threat-research/2015/06/operation-clandestine-wolf-adobe-flash-zero-day.html"},{"source_name":"Palo Alto CVE-2015-3113 July 2015","description":"Falcone, R. and Wartell, R.. (2015, July 27). Observations on CVE-2015-3113, Prior Zero-Days and the Pirpi Payload. Retrieved January 22, 2016.","url":"http://researchcenter.paloaltonetworks.com/2015/07/ups-observations-on-cve-2015-3113-prior-zero-days-and-the-pirpi-payload/"}]},{"id":"S0070","name":"HTTPBrowser","url":"https://attack.mitre.org/software/S0070","kind":"malware","description":"[HTTPBrowser](https://attack.mitre.org/software/S0070)'s code may be obfuscated through structured exception handling and return-oriented programming.(Citation: Dell TG-3390)","relationship_id":"relationship--291b7fbf-5b5f-460a-8009-cadb383b3262","references":[{"source_name":"Dell TG-3390","description":"Dell SecureWorks Counter Threat Unit Threat Intelligence. (2015, August 5). Threat Group-3390 Targets Organizations for Cyberespionage. Retrieved August 18, 2018.","url":"https://www.secureworks.com/research/threat-group-3390-targets-organizations-for-cyberespionage"}]},{"id":"S0091","name":"Epic","url":"https://attack.mitre.org/software/S0091","kind":"malware","description":"[Epic](https://attack.mitre.org/software/S0091) heavily obfuscates its code to make analysis more difficult.(Citation: Kaspersky Turla)","relationship_id":"relationship--e600fe60-36d1-4053-af2f-13830d95bd14","references":[{"source_name":"Kaspersky Turla","description":"Kaspersky Lab's Global Research and Analysis Team. (2014, August 7). The Epic Turla Operation: Solving some of the mysteries of Snake/Uroburos. Retrieved December 11, 2014.","url":"https://securelist.com/the-epic-turla-operation/65545/"}]},{"id":"S0094","name":"Trojan.Karagany","url":"https://attack.mitre.org/software/S0094","kind":"malware","description":"[Trojan.Karagany](https://attack.mitre.org/software/S0094) can base64 encode and AES-128-CBC encrypt data prior to transmission.(Citation: Secureworks Karagany July 2019)","relationship_id":"relationship--2b00f3f4-ddde-4874-8315-5a5c5d671a33","references":[{"source_name":"Secureworks Karagany July 2019","description":"Secureworks. (2019, July 24). Updated Karagany Malware Targets Energy Sector. Retrieved August 12, 2020.","url":"https://www.secureworks.com/research/updated-karagany-malware-targets-energy-sector"}]},{"id":"S0117","name":"XTunnel","url":"https://attack.mitre.org/software/S0117","kind":"malware","description":"A version of [XTunnel](https://attack.mitre.org/software/S0117) introduced in July 2015 obfuscated the binary using opaque predicates and other techniques in a likely attempt to obfuscate it and bypass security products.(Citation: ESET Sednit Part 2)","relationship_id":"relationship--e8d2c3f1-7c86-438c-bead-6a86f9a36463","references":[{"source_name":"ESET Sednit Part 2","description":"ESET. (2016, October). En Route with Sednit - Part 2: Observing the Comings and Goings. Retrieved November 21, 2016.","url":"http://www.welivesecurity.com/wp-content/uploads/2016/10/eset-sednit-part-2.pdf"}]},{"id":"S0124","name":"Pisloader","url":"https://attack.mitre.org/software/S0124","kind":"malware","description":"[Pisloader](https://attack.mitre.org/software/S0124) obfuscates files by splitting strings into smaller sub-strings and including \"garbage\" strings that are never used. The malware also uses return-oriented programming (ROP) technique and single-byte XOR to obfuscate data.(Citation: Palo Alto DNS Requests)","relationship_id":"relationship--cbc4c186-028e-4a24-93ff-5f2bb7edd98a","references":[{"source_name":"Palo Alto DNS Requests","description":"Grunzweig, J., et al. (2016, May 24). New Wekby Attacks Use DNS Requests As Command and Control Mechanism. Retrieved August 17, 2016.","url":"http://researchcenter.paloaltonetworks.com/2016/05/unit42-new-wekby-attacks-use-dns-requests-as-command-and-control-mechanism/"}]},{"id":"S0126","name":"ComRAT","url":"https://attack.mitre.org/software/S0126","kind":"malware","description":"[ComRAT](https://attack.mitre.org/software/S0126) has encrypted its virtual file system using AES-256 in XTS mode.(Citation: ESET ComRAT May 2020)(Citation: CISA ComRAT Oct 2020) ","relationship_id":"relationship--3a86072e-4ca6-4b5d-bf31-b17c250f572e","references":[{"source_name":"CISA ComRAT Oct 2020","description":"CISA. (2020, October 29). Malware Analysis Report (AR20-303A). Retrieved December 9, 2020.","url":"https://us-cert.cisa.gov/ncas/analysis-reports/ar20-303a"},{"source_name":"ESET ComRAT May 2020","description":"Faou, M. (2020, May). From Agent.btz to ComRAT v4: A ten-year journey. Retrieved June 15, 2020.","url":"https://www.welivesecurity.com/wp-content/uploads/2020/05/ESET_Turla_ComRAT.pdf"}]},{"id":"S0132","name":"H1N1","url":"https://attack.mitre.org/software/S0132","kind":"malware","description":"[H1N1](https://attack.mitre.org/software/S0132) uses multiple techniques to obfuscate strings, including XOR.(Citation: Cisco H1N1 Part 1)","relationship_id":"relationship--4527c528-8377-4349-ae5c-95c04cabd3d4","references":[{"source_name":"Cisco H1N1 Part 1","description":"Reynolds, J.. (2016, September 13). H1N1: Technical analysis reveals new capabilities. Retrieved September 26, 2016.","url":"http://blogs.cisco.com/security/h1n1-technical-analysis-reveals-new-capabilities"}]},{"id":"S0137","name":"CORESHELL","url":"https://attack.mitre.org/software/S0137","kind":"malware","description":"[CORESHELL](https://attack.mitre.org/software/S0137) obfuscates strings using a custom stream cipher.(Citation: FireEye APT28)","relationship_id":"relationship--e6f5bde4-869f-4c9a-9414-11ea48386204","references":[{"source_name":"FireEye APT28","description":"FireEye. (2015). APT28: A WINDOW INTO RUSSIA’S CYBER ESPIONAGE OPERATIONS?. Retrieved August 19, 2015.","url":"https://web.archive.org/web/20151022204649/https://www.fireeye.com/content/dam/fireeye-www/global/en/current-threats/pdfs/rpt-apt28.pdf"}]},{"id":"S0138","name":"OLDBAIT","url":"https://attack.mitre.org/software/S0138","kind":"malware","description":"[OLDBAIT](https://attack.mitre.org/software/S0138) obfuscates internal strings and unpacks them at startup.(Citation: FireEye APT28)","relationship_id":"relationship--8e82a523-fc73-4f3b-98dc-3b1e7199cd93","references":[{"source_name":"FireEye APT28","description":"FireEye. (2015). APT28: A WINDOW INTO RUSSIA’S CYBER ESPIONAGE OPERATIONS?. Retrieved August 19, 2015.","url":"https://web.archive.org/web/20151022204649/https://www.fireeye.com/content/dam/fireeye-www/global/en/current-threats/pdfs/rpt-apt28.pdf"}]},{"id":"S0140","name":"Shamoon","url":"https://attack.mitre.org/software/S0140","kind":"malware","description":"[Shamoon](https://attack.mitre.org/software/S0140) contains base64-encoded strings.(Citation: Palo Alto Shamoon Nov 2016)","relationship_id":"relationship--59df5f14-e570-417e-8184-e8e7c6c1ea75","references":[{"source_name":"Palo Alto Shamoon Nov 2016","description":"Falcone, R.. (2016, November 30). Shamoon 2: Return of the Disttrack Wiper. Retrieved January 11, 2017.","url":"http://researchcenter.paloaltonetworks.com/2016/11/unit42-shamoon-2-return-disttrack-wiper/"}]},{"id":"S0142","name":"StreamEx","url":"https://attack.mitre.org/software/S0142","kind":"malware","description":"[StreamEx](https://attack.mitre.org/software/S0142) obfuscates some commands by using statically programmed fragments of strings when starting a DLL. It also uses a one-byte xor against 0x91 to encode configuration data.(Citation: Cylance Shell Crew Feb 2017)","relationship_id":"relationship--ee51d531-5cc4-4836-a55c-6062bde1a4d4","references":[{"source_name":"Cylance Shell Crew Feb 2017","description":"Cylance SPEAR Team. (2017, February 9). Shell Crew Variants Continue to Fly Under Big AV’s Radar. Retrieved February 15, 2017.","url":"https://www.cylance.com/shell-crew-variants-continue-to-fly-under-big-avs-radar"}]},{"id":"S0148","name":"RTM","url":"https://attack.mitre.org/software/S0148","kind":"malware","description":"[RTM](https://attack.mitre.org/software/S0148) strings, network data, configuration, and modules are encrypted with a modified RC4 algorithm.(Citation: ESET RTM Feb 2017)(Citation: Unit42 Redaman January 2019)","relationship_id":"relationship--d5c86dd3-3cfa-4ade-8984-fdf079b9f81b","references":[{"source_name":"Unit42 Redaman January 2019","description":"Duncan, B., Harbison, M. (2019, January 23). Russian Language Malspam Pushing Redaman Banking Malware. Retrieved June 16, 2020.","url":"https://unit42.paloaltonetworks.com/russian-language-malspam-pushing-redaman-banking-malware/"},{"source_name":"ESET RTM Feb 2017","description":"Faou, M. and Boutin, J. (2017, February). Read The Manual: A Guide to the RTM Banking Trojan. Retrieved March 9, 2017.","url":"https://www.welivesecurity.com/wp-content/uploads/2017/02/Read-The-Manual.pdf"}]},{"id":"S0150","name":"POSHSPY","url":"https://attack.mitre.org/software/S0150","kind":"malware","description":"[POSHSPY](https://attack.mitre.org/software/S0150) appends a file signature header (randomly selected from six file types) to encrypted data prior to upload or download.(Citation: FireEye POSHSPY April 2017)","relationship_id":"relationship--70edcba2-e777-4ced-a52d-5dfc3965211c","references":[{"source_name":"FireEye POSHSPY April 2017","description":"Dunwoody, M.. (2017, April 3). Dissecting One of APT29’s Fileless WMI and PowerShell Backdoors (POSHSPY). Retrieved April 5, 2017.","url":"https://www.fireeye.com/blog/threat-research/2017/03/dissecting_one_ofap.html"}]},{"id":"S0154","name":"Cobalt Strike","url":"https://attack.mitre.org/software/S0154","kind":"malware","description":"[Cobalt Strike](https://attack.mitre.org/software/S0154) can hash functions to obfuscate calls to the Windows API and use a public/private key pair to encrypt Beacon session metadata.(Citation: Talos Cobalt Strike September 2020)(Citation: Cobalt Strike Manual 4.3 November 2020)","relationship_id":"relationship--fe57d6a5-09d4-4642-9b71-cfcf9b9e0de1","references":[{"source_name":"Talos Cobalt Strike September 2020","description":"Mavis, N. (2020, September 21). The Art and Science of Detecting Cobalt Strike. Retrieved September 12, 2024.","url":"https://web.archive.org/web/20210219195905/https://talos-intelligence-site.s3.amazonaws.com/production/document_files/files/000/095/031/original/Talos_Cobalt_Strike.pdf"},{"source_name":"Cobalt Strike Manual 4.3 November 2020","description":"Strategic Cyber LLC. (2020, November 5). Cobalt Strike: Advanced Threat Tactics for Penetration Testers. Retrieved April 13, 2021.","url":"https://web.archive.org/web/20210708035426/https://www.cobaltstrike.com/downloads/csmanual43.pdf"}]},{"id":"S0167","name":"Matryoshka","url":"https://attack.mitre.org/software/S0167","kind":"malware","description":"[Matryoshka](https://attack.mitre.org/software/S0167) obfuscates API function names using a substitute cipher combined with Base64 encoding.(Citation: CopyKittens Nov 2015)","relationship_id":"relationship--573916d8-804d-4453-be37-e6b1865e87db","references":[{"source_name":"CopyKittens Nov 2015","description":"Minerva Labs LTD and ClearSky Cyber Security. (2015, November 23). CopyKittens Attack Group. Retrieved November 17, 2024.","url":"https://cdn2.hubspot.net/hubfs/1903456/Whitepapers/CopyKittens.pdf"}]},{"id":"S0182","name":"FinFisher","url":"https://attack.mitre.org/software/S0182","kind":"malware","description":"[FinFisher](https://attack.mitre.org/software/S0182) is heavily obfuscated in many ways, including through the use of spaghetti code in its functions in an effort to confuse disassembly programs. It also uses a custom XOR algorithm to obfuscate code.(Citation: FinFisher Citation)(Citation: Microsoft FinFisher March 2018)","relationship_id":"relationship--f75caad1-161a-4833-b3ec-f4538e1603fe","references":[{"source_name":"Microsoft FinFisher March 2018","description":"Allievi, A.,Flori, E. (2018, March 01). FinFisher exposed: A researcher’s tale of defeating traps, tricks, and complex virtual machines. Retrieved July 9, 2018.","url":"https://cloudblogs.microsoft.com/microsoftsecure/2018/03/01/finfisher-exposed-a-researchers-tale-of-defeating-traps-tricks-and-complex-virtual-machines/"},{"source_name":"FinFisher Citation","description":"FinFisher. (n.d.). Retrieved September 12, 2024.","url":"https://web.archive.org/web/20171222050934/http://www.finfisher.com/FinFisher/index.html"}]},{"id":"S0187","name":"Daserf","url":"https://attack.mitre.org/software/S0187","kind":"malware","description":"[Daserf](https://attack.mitre.org/software/S0187) uses encrypted Windows APIs and also encrypts data using the alternative base64+RC4 or the Caesar cipher.(Citation: Trend Micro Daserf Nov 2017)","relationship_id":"relationship--92b34cc0-b059-4294-824f-bb92298f3ae6","references":[{"source_name":"Trend Micro Daserf Nov 2017","description":"Chen, J. and Hsieh, M. (2017, November 7). REDBALDKNIGHT/BRONZE BUTLER’s Daserf Backdoor Now Using Steganography. Retrieved December 27, 2017.","url":"http://blog.trendmicro.com/trendlabs-security-intelligence/redbaldknight-bronze-butler-daserf-backdoor-now-using-steganography/"}]},{"id":"S0189","name":"ISMInjector","url":"https://attack.mitre.org/software/S0189","kind":"malware","description":"[ISMInjector](https://attack.mitre.org/software/S0189) is obfuscated with the off-the-shelf SmartAssembly .NET obfuscator created by red-gate.com.(Citation: OilRig New Delivery Oct 2017)","relationship_id":"relationship--a0500766-a6ba-4672-b7fc-2a712cd0cfca","references":[{"source_name":"OilRig New Delivery Oct 2017","description":"Falcone, R. and Lee, B. (2017, October 9). OilRig Group Steps Up Attacks with New Delivery Documents and New Injector Trojan. Retrieved January 8, 2018.","url":"https://researchcenter.paloaltonetworks.com/2017/10/unit42-oilrig-group-steps-attacks-new-delivery-documents-new-injector-trojan/"}]},{"id":"S0196","name":"PUNCHBUGGY","url":"https://attack.mitre.org/software/S0196","kind":"malware","description":"[PUNCHBUGGY](https://attack.mitre.org/software/S0196) has hashed most its code's functions and encrypted payloads with base64 and XOR.(Citation: Morphisec ShellTea June 2019)","relationship_id":"relationship--e2e74982-a4a6-428f-888a-a910453b7e82","references":[{"source_name":"Morphisec ShellTea June 2019","description":"Gorelik, M.. (2019, June 10). SECURITY ALERT: FIN8 IS BACK IN BUSINESS, TARGETING THE HOSPITALITY INDUSTRY. Retrieved June 13, 2019.","url":"http://blog.morphisec.com/security-alert-fin8-is-back"}]},{"id":"S0197","name":"PUNCHTRACK","url":"https://attack.mitre.org/software/S0197","kind":"malware","description":"[PUNCHTRACK](https://attack.mitre.org/software/S0197) is loaded and executed by a highly obfuscated launcher.(Citation: FireEye Fin8 May 2016)","relationship_id":"relationship--1f8be617-c842-4828-a352-9d5eafb8f477","references":[{"source_name":"FireEye Fin8 May 2016","description":"Kizhakkinan, D., et al. (2016, May 11). Threat Actor Leverages Windows Zero-day Exploit in Payment Card Data Attacks. Retrieved February 12, 2018.","url":"https://www.fireeye.com/blog/threat-research/2016/05/windows-zero-day-payment-cards.html"}]},{"id":"S0198","name":"NETWIRE","url":"https://attack.mitre.org/software/S0198","kind":"malware","description":"[NETWIRE](https://attack.mitre.org/software/S0198) has used a custom obfuscation algorithm to hide strings including Registry keys, APIs, and DLL names.(Citation: FireEye NETWIRE March 2019)","relationship_id":"relationship--4a339bd7-d356-44fb-9677-8f082af2fc11","references":[{"source_name":"FireEye NETWIRE March 2019","description":"Maniath, S. and Kadam P. (2019, March 19). Dissecting a NETWIRE Phishing Campaign's Usage of Process Hollowing. Retrieved January 7, 2021.","url":"https://www.mandiant.com/resources/blog/dissecting-netwire-phishing-campaigns-usage-process-hollowing"}]},{"id":"S0201","name":"JPIN","url":"https://attack.mitre.org/software/S0201","kind":"malware","description":"A [JPIN](https://attack.mitre.org/software/S0201) uses a encrypted and compressed payload that is disguised as a bitmap within the resource section of the installer.(Citation: Microsoft PLATINUM April 2016)","relationship_id":"relationship--d2263afd-2fd3-4f98-96a5-a00e5f33b99e","references":[{"source_name":"Microsoft PLATINUM April 2016","description":"Windows Defender Advanced Threat Hunting Team. (2016, April 29). PLATINUM: Targeted attacks in South and Southeast Asia. Retrieved February 15, 2018.","url":"https://download.microsoft.com/download/2/2/5/225BFE3E-E1DE-4F5B-A77B-71200928D209/Platinum%20feature%20article%20-%20Targeted%20attacks%20in%20South%20and%20Southeast%20Asia%20April%202016.pdf"}]},{"id":"S0203","name":"Hydraq","url":"https://attack.mitre.org/software/S0203","kind":"malware","description":"[Hydraq](https://attack.mitre.org/software/S0203) uses basic obfuscation in the form of spaghetti code.(Citation: Symantec Elderwood Sept 2012)(Citation: Symantec Trojan.Hydraq Jan 2010)","relationship_id":"relationship--5ef1c7d8-70bc-4634-b705-644f4d1db3b0","references":[{"source_name":"Symantec Elderwood Sept 2012","description":"O'Gorman, G., and McDonald, G.. (2012, September 6). The Elderwood Project. Retrieved November 17, 2024.","url":"https://web.archive.org/web/20190717233006/http:/www.symantec.com/content/en/us/enterprise/media/security_response/whitepapers/the-elderwood-project.pdf"},{"source_name":"Symantec Trojan.Hydraq Jan 2010","description":"Symantec Security Response. (2010, January 18). The Trojan.Hydraq Incident. Retrieved February 20, 2018.","url":"https://www.symantec.com/connect/blogs/trojanhydraq-incident"}]},{"id":"S0229","name":"Orz","url":"https://attack.mitre.org/software/S0229","kind":"malware","description":"Some [Orz](https://attack.mitre.org/software/S0229) strings are base64 encoded, such as the embedded DLL known as MockDll.(Citation: Proofpoint Leviathan Oct 2017)","relationship_id":"relationship--fa6f0d89-8a80-421b-bcb1-ef5ee31f0879","references":[{"source_name":"Proofpoint Leviathan Oct 2017","description":"Axel F, Pierre T. (2017, October 16). Leviathan: Espionage actor spearphishes maritime and defense targets. Retrieved February 15, 2018.","url":"https://www.proofpoint.com/us/threat-insight/post/leviathan-espionage-actor-spearphishes-maritime-and-defense-targets"}]},{"id":"S0240","name":"ROKRAT","url":"https://attack.mitre.org/software/S0240","kind":"malware","description":"[ROKRAT](https://attack.mitre.org/software/S0240) can encrypt data prior to exfiltration by using an RSA public key.(Citation: Volexity InkySquid RokRAT August 2021)(Citation: Malwarebytes RokRAT VBA January 2021)","relationship_id":"relationship--8a41eff0-83f3-414a-af49-54f0f8c1b84a","references":[{"source_name":"Volexity InkySquid RokRAT August 2021","description":"Cash, D., Grunzweig, J., Adair, S., Lancaster, T. (2021, August 25). North Korean BLUELIGHT Special: InkySquid Deploys RokRAT. Retrieved October 1, 2021.","url":"https://www.volexity.com/blog/2021/08/24/north-korean-bluelight-special-inkysquid-deploys-rokrat/"},{"source_name":"Malwarebytes RokRAT VBA January 2021","description":"Jazi, Hossein. (2021, January 6). Retrohunting APT37: North Korean APT used VBA self decode technique to inject RokRat. Retrieved March 22, 2022.","url":"https://blog.malwarebytes.com/threat-analysis/2021/01/retrohunting-apt37-north-korean-apt-used-vba-self-decode-technique-to-inject-rokrat/"}]},{"id":"S0242","name":"SynAck","url":"https://attack.mitre.org/software/S0242","kind":"malware","description":"[SynAck](https://attack.mitre.org/software/S0242) payloads are obfuscated prior to compilation to inhibit analysis and/or reverse engineering.(Citation: SecureList SynAck Doppelgänging May 2018)(Citation: Kaspersky Lab SynAck May 2018)","relationship_id":"relationship--142ef662-460f-4082-8f76-f08dd312bc30","references":[{"source_name":"SecureList SynAck Doppelgänging May 2018","description":"Ivanov, A. et al. (2018, May 7). SynAck targeted ransomware uses the Doppelgänging technique. Retrieved May 22, 2018.","url":"https://securelist.com/synack-targeted-ransomware-uses-the-doppelganging-technique/85431/"},{"source_name":"Kaspersky Lab SynAck May 2018","description":"Bettencourt, J. (2018, May 7). Kaspersky Lab finds new variant of SynAck ransomware using sophisticated Doppelgänging technique. Retrieved May 24, 2018.","url":"https://usa.kaspersky.com/about/press-releases/2018_synack-doppelganging"}]},{"id":"S0244","name":"Comnie","url":"https://attack.mitre.org/software/S0244","kind":"malware","description":"[Comnie](https://attack.mitre.org/software/S0244) uses RC4 and Base64 to obfuscate strings.(Citation: Palo Alto Comnie)","relationship_id":"relationship--ff3d2ebf-ea7b-4fd2-a524-9a6f20bcf3e3","references":[{"source_name":"Palo Alto Comnie","description":"Grunzweig, J. (2018, January 31). Comnie Continues to Target Organizations in East Asia. Retrieved June 7, 2018.","url":"https://researchcenter.paloaltonetworks.com/2018/01/unit42-comnie-continues-target-organizations-east-asia/"}]},{"id":"S0259","name":"InnaputRAT","url":"https://attack.mitre.org/software/S0259","kind":"malware","description":"[InnaputRAT](https://attack.mitre.org/software/S0259) uses an 8-byte XOR key to obfuscate API names and other strings contained in the payload.(Citation: ASERT InnaputRAT April 2018)","relationship_id":"relationship--549fdc30-5269-48ee-9dc8-60db8deb836a","references":[{"source_name":"ASERT InnaputRAT April 2018","description":"ASERT Team. (2018, April 04). Innaput Actors Utilize Remote Access Trojan Since 2016, Presumably Targeting Victim Files. Retrieved July 9, 2018.","url":"https://asert.arbornetworks.com/innaput-actors-utilize-remote-access-trojan-since-2016-presumably-targeting-victim-files/"}]},{"id":"S0260","name":"InvisiMole","url":"https://attack.mitre.org/software/S0260","kind":"malware","description":"[InvisiMole](https://attack.mitre.org/software/S0260) avoids analysis by encrypting all strings, internal files, configuration data and by using a custom executable format.(Citation: ESET InvisiMole June 2018)(Citation: ESET InvisiMole June 2020)","relationship_id":"relationship--9e8f8dce-1921-4738-ae7f-30290a350cf2","references":[{"source_name":"ESET InvisiMole June 2018","description":"Hromcová, Z. (2018, June 07). InvisiMole: Surprisingly equipped spyware, undercover since 2013. Retrieved July 10, 2018.","url":"https://www.welivesecurity.com/2018/06/07/invisimole-equipped-spyware-undercover/"},{"source_name":"ESET InvisiMole June 2020","description":"Hromcova, Z. and Cherpanov, A. (2020, June). INVISIMOLE: THE HIDDEN PART OF THE STORY. Retrieved July 16, 2020.","url":"https://www.welivesecurity.com/wp-content/uploads/2020/06/ESET_InvisiMole.pdf"}]},{"id":"S0264","name":"OopsIE","url":"https://attack.mitre.org/software/S0264","kind":"malware","description":"[OopsIE](https://attack.mitre.org/software/S0264) uses the Confuser protector to obfuscate an embedded .Net Framework assembly used for C2. [OopsIE](https://attack.mitre.org/software/S0264) also encodes collected data in hexadecimal format before writing to files on disk and obfuscates strings.(Citation: Unit 42 OopsIE! Feb 2018)(Citation: Unit 42 OilRig Sept 2018)","relationship_id":"relationship--ec9e1757-50c1-4fd8-a0be-2694b1bc9e99","references":[{"source_name":"Unit 42 OopsIE! Feb 2018","description":"Lee, B., Falcone, R. (2018, February 23). OopsIE! OilRig Uses ThreeDollars to Deliver New Trojan. Retrieved July 16, 2018.","url":"https://researchcenter.paloaltonetworks.com/2018/02/unit42-oopsie-oilrig-uses-threedollars-deliver-new-trojan/"},{"source_name":"Unit 42 OilRig Sept 2018","description":"Falcone, R., et al. (2018, September 04). OilRig Targets a Middle Eastern Government and Adds Evasion Techniques to OopsIE. Retrieved September 24, 2018.","url":"https://researchcenter.paloaltonetworks.com/2018/09/unit42-oilrig-targets-middle-eastern-government-adds-evasion-techniques-oopsie/"}]},{"id":"S0265","name":"Kazuar","url":"https://attack.mitre.org/software/S0265","kind":"malware","description":"[Kazuar](https://attack.mitre.org/software/S0265) is obfuscated using the open source ConfuserEx protector. [Kazuar](https://attack.mitre.org/software/S0265) also obfuscates the name of created files/folders/mutexes and encrypts debug messages written to log files using the Rijndael cipher.(Citation: Unit 42 Kazuar May 2017)","relationship_id":"relationship--464e688d-b243-4619-a60b-1be6e2d6a827","references":[{"source_name":"Unit 42 Kazuar May 2017","description":"Levene, B, et al. (2017, May 03). Kazuar: Multiplatform Espionage Backdoor with API Access. Retrieved July 17, 2018.","url":"https://researchcenter.paloaltonetworks.com/2017/05/unit42-kazuar-multiplatform-espionage-backdoor-api-access/"}]},{"id":"S0266","name":"TrickBot","url":"https://attack.mitre.org/software/S0266","kind":"malware","description":"[TrickBot](https://attack.mitre.org/software/S0266) uses non-descriptive names to hide functionality.(Citation: S2 Grupo TrickBot June 2017)","relationship_id":"relationship--4ff492bf-f91d-445d-a29e-6e60c67a05c1","references":[{"source_name":"S2 Grupo TrickBot June 2017","description":"Salinas, M., Holguin, J. (2017, June). Evolution of Trickbot. Retrieved July 31, 2018.","url":"https://www.securityartwork.es/wp-content/uploads/2017/07/Trickbot-report-S2-Grupo.pdf"}]},{"id":"S0283","name":"jRAT","url":"https://attack.mitre.org/software/S0283","kind":"malware","description":"[jRAT](https://attack.mitre.org/software/S0283)’s Java payload is encrypted with AES.(Citation: jRAT Symantec Aug 2018) Additionally, backdoor files are encrypted using DES as a stream cipher. Later variants of [jRAT](https://attack.mitre.org/software/S0283) also incorporated AV evasion methods such as Java bytecode obfuscation via the commercial Allatori obfuscation tool.(Citation: Symantec Frutas Feb 2013)","relationship_id":"relationship--ec2e27c9-71fe-4650-a5b9-1247193c39f6","references":[{"source_name":"jRAT Symantec Aug 2018","description":"Sharma, R. (2018, August 15). Revamped jRAT Uses New Anti-Parsing Techniques. Retrieved September 21, 2018.","url":"https://www.symantec.com/blogs/threat-intelligence/jrat-new-anti-parsing-techniques"},{"source_name":"Symantec Frutas Feb 2013","description":"Bingham, J. (2013, February 11). Cross-Platform Frutas RAT Builder and Back Door. Retrieved April 23, 2019.","url":"https://www.symantec.com/connect/blogs/cross-platform-frutas-rat-builder-and-back-door"}]},{"id":"S0331","name":"Agent Tesla","url":"https://attack.mitre.org/software/S0331","kind":"malware","description":"[Agent Tesla](https://attack.mitre.org/software/S0331) has had its code obfuscated in an apparent attempt to make analysis difficult.(Citation: Fortinet Agent Tesla April 2018) [Agent Tesla](https://attack.mitre.org/software/S0331) has used the Rijndael symmetric encryption algorithm to encrypt strings.(Citation: Malwarebytes Agent Tesla April 2020)","relationship_id":"relationship--4d7e8d98-9894-4dfa-9013-af8d83e6faea","references":[{"source_name":"Fortinet Agent Tesla April 2018","description":"Zhang, X. (2018, April 05). Analysis of New Agent Tesla Spyware Variant. Retrieved November 5, 2018.","url":"https://www.fortinet.com/blog/threat-research/analysis-of-new-agent-tesla-spyware-variant.html"},{"source_name":"Malwarebytes Agent Tesla April 2020","description":"Jazi, H. (2020, April 16). New AgentTesla variant steals WiFi credentials. Retrieved May 19, 2020.","url":"https://blog.malwarebytes.com/threat-analysis/2020/04/new-agenttesla-variant-steals-wifi-credentials/"}]},{"id":"S0332","name":"Remcos","url":"https://attack.mitre.org/software/S0332","kind":"tool","description":"[Remcos](https://attack.mitre.org/software/S0332) uses RC4 and base64 to obfuscate data, including Registry entries and file paths.(Citation: Talos Remcos Aug 2018) [Remcos](https://attack.mitre.org/software/S0332) can also employ control flow flattening to hinder analysis.(Citation: Check Point Blind Eagle MAR 2025)","relationship_id":"relationship--71a121ba-b01c-418c-af8d-63df2cec70de","references":[{"source_name":"Talos Remcos Aug 2018","description":"Brumaghin, E., Unterbrink, H. (2018, August 22). Picking Apart Remcos Botnet-In-A-Box. Retrieved November 6, 2018.","url":"https://blog.talosintelligence.com/2018/08/picking-apart-remcos.html"},{"source_name":"Check Point Blind Eagle MAR 2025","description":"Check Point Research. (2025, March 10). Blind Eagle: …And Justice for All. Retrieved April 16, 2026.","url":"https://research.checkpoint.com/2025/blind-eagle-and-justice-for-all/"}]},{"id":"S0335","name":"Carbon","url":"https://attack.mitre.org/software/S0335","kind":"malware","description":"[Carbon](https://attack.mitre.org/software/S0335) encrypts configuration files and tasks for the malware to complete using CAST-128 algorithm.(Citation: ESET Carbon Mar 2017)(Citation: Accenture HyperStack October 2020)","relationship_id":"relationship--aac99c91-e1b1-42c0-8a13-f166027d5168","references":[{"source_name":"Accenture HyperStack October 2020","description":"Accenture. (2020, October). Turla uses HyperStack, Carbon, and Kazuar to compromise government entity. Retrieved December 2, 2020.","url":"https://web.archive.org/web/20201101015247/https://www.accenture.com/us-en/blogs/cyber-defense/turla-belugasturgeon-compromises-government-entity"},{"source_name":"ESET Carbon Mar 2017","description":"ESET. (2017, March 30). Carbon Paper: Peering into Turla’s second stage backdoor. Retrieved November 7, 2018.","url":"https://www.welivesecurity.com/2017/03/30/carbon-paper-peering-turlas-second-stage-backdoor/"}]},{"id":"S0336","name":"NanoCore","url":"https://attack.mitre.org/software/S0336","kind":"malware","description":"[NanoCore](https://attack.mitre.org/software/S0336)’s plugins were obfuscated with Eazfuscater.NET 3.3.(Citation: PaloAlto NanoCore Feb 2016)","relationship_id":"relationship--2f884873-308c-4bee-94bd-90bb2267fea7","references":[{"source_name":"PaloAlto NanoCore Feb 2016","description":"Kasza, A., Halfpop, T. (2016, February 09). NanoCoreRAT Behind an Increase in Tax-Themed Phishing E-mails. Retrieved November 9, 2018.","url":"https://researchcenter.paloaltonetworks.com/2016/02/nanocorerat-behind-an-increase-in-tax-themed-phishing-e-mails/"}]},{"id":"S0353","name":"NOKKI","url":"https://attack.mitre.org/software/S0353","kind":"malware","description":"[NOKKI](https://attack.mitre.org/software/S0353) uses Base64 encoding for strings.(Citation: Unit 42 NOKKI Sept 2018)","relationship_id":"relationship--6f5973be-3c51-4bd1-b652-f12903caa3e2","references":[{"source_name":"Unit 42 NOKKI Sept 2018","description":"Grunzweig, J., Lee, B. (2018, September 27). New KONNI Malware attacking Eurasia and Southeast Asia. Retrieved November 5, 2018.","url":"https://researchcenter.paloaltonetworks.com/2018/09/unit42-new-konni-malware-attacking-eurasia-southeast-asia/"}]},{"id":"S0354","name":"Denis","url":"https://attack.mitre.org/software/S0354","kind":"malware","description":"[Denis](https://attack.mitre.org/software/S0354) obfuscates its code and encrypts the API names.(Citation: Cybereason Cobalt Kitty 2017)","relationship_id":"relationship--f4881cea-8d6f-4cb6-ab86-5aab2379c695","references":[{"source_name":"Cybereason Cobalt Kitty 2017","description":"Dahan, A. (2017). Operation Cobalt Kitty. Retrieved December 27, 2018.","url":"https://cdn2.hubspot.net/hubfs/3354902/Cybereason%20Labs%20Analysis%20Operation%20Cobalt%20Kitty.pdf"}]},{"id":"S0355","name":"Final1stspy","url":"https://attack.mitre.org/software/S0355","kind":"malware","description":"[Final1stspy](https://attack.mitre.org/software/S0355) obfuscates strings with base64 encoding.(Citation: Unit 42 Nokki Oct 2018)","relationship_id":"relationship--3c92a16b-9f72-4f79-a656-e79c6c04e48f","references":[{"source_name":"Unit 42 Nokki Oct 2018","description":"Grunzweig, J. (2018, October 01). NOKKI Almost Ties the Knot with DOGCALL: Reaper Group Uses New Malware to Deploy RAT. Retrieved November 5, 2018.","url":"https://researchcenter.paloaltonetworks.com/2018/10/unit42-nokki-almost-ties-the-knot-with-dogcall-reaper-group-uses-new-malware-to-deploy-rat/"}]},{"id":"S0369","name":"CoinTicker","url":"https://attack.mitre.org/software/S0369","kind":"malware","description":"[CoinTicker](https://attack.mitre.org/software/S0369) initially downloads a hidden encoded file.(Citation: CoinTicker 2019)","relationship_id":"relationship--342502b6-c8fc-4ed5-ba10-209a824b78ed","references":[{"source_name":"CoinTicker 2019","description":"Thomas Reed. (2018, October 29). Mac cryptocurrency ticker app installs backdoors. Retrieved April 23, 2019.","url":"https://blog.malwarebytes.com/threat-analysis/2018/10/mac-cryptocurrency-ticker-app-installs-backdoors/"}]},{"id":"S0377","name":"Ebury","url":"https://attack.mitre.org/software/S0377","kind":"malware","description":"[Ebury](https://attack.mitre.org/software/S0377) has obfuscated its strings with a simple XOR encryption with a static key.(Citation: ESET Ebury Feb 2014)","relationship_id":"relationship--9af6241d-355a-4673-b772-8384a718ed64","references":[{"source_name":"ESET Ebury Feb 2014","description":"M.Léveillé, M.. (2014, February 21). An In-depth Analysis of Linux/Ebury. Retrieved April 19, 2019.","url":"https://www.welivesecurity.com/2014/02/21/an-in-depth-analysis-of-linuxebury/"}]},{"id":"S0384","name":"Dridex","url":"https://attack.mitre.org/software/S0384","kind":"malware","description":"[Dridex](https://attack.mitre.org/software/S0384)'s strings are obfuscated using RC4.(Citation: Checkpoint Dridex Jan 2021) ","relationship_id":"relationship--6b8d8354-0fa9-4a45-8df9-57709beace42","references":[{"source_name":"Checkpoint Dridex Jan 2021","description":"Check Point Research. (2021, January 4). Stopping Serial Killer: Catching the Next Strike. Retrieved September 7, 2021.","url":"https://research.checkpoint.com/2021/stopping-serial-killer-catching-the-next-strike/"}]},{"id":"S0393","name":"PowerStallion","url":"https://attack.mitre.org/software/S0393","kind":"malware","description":"[PowerStallion](https://attack.mitre.org/software/S0393) uses a XOR cipher to encrypt command output written to its OneDrive C2 server.(Citation: ESET Turla PowerShell May 2019)","relationship_id":"relationship--11ea144c-253e-4f68-bb2c-1f942cba6b54","references":[{"source_name":"ESET Turla PowerShell May 2019","description":"Faou, M. and Dumont R.. (2019, May 29). A dive into Turla PowerShell usage. Retrieved June 14, 2019.","url":"https://www.welivesecurity.com/2019/05/29/turla-powershell-usage/"}]},{"id":"S0428","name":"PoetRAT","url":"https://attack.mitre.org/software/S0428","kind":"malware","description":"[PoetRAT](https://attack.mitre.org/software/S0428) has used a custom encryption scheme for communication between scripts.(Citation: Talos PoetRAT April 2020)","relationship_id":"relationship--e159049f-70c1-4349-b299-c1d99d06901d","references":[{"source_name":"Talos PoetRAT April 2020","description":"Mercer, W, et al. (2020, April 16). PoetRAT: Python RAT uses COVID-19 lures to target Azerbaijan public and private sectors. Retrieved April 27, 2020.","url":"https://blog.talosintelligence.com/2020/04/poetrat-covid-19-lures.html"}]},{"id":"S0434","name":"Imminent Monitor","url":"https://attack.mitre.org/software/S0434","kind":"tool","description":"[Imminent Monitor](https://attack.mitre.org/software/S0434) has encrypted the spearphish attachments to avoid detection from email gateways; the debugger also encrypts information before sending to the C2.(Citation: QiAnXin APT-C-36 Feb2019)","relationship_id":"relationship--c3aa5639-a8e1-4de3-8f39-cc98593973ed","references":[{"source_name":"QiAnXin APT-C-36 Feb2019","description":"QiAnXin Threat Intelligence Center. (2019, February 18). APT-C-36: Continuous Attacks Targeting Colombian Government Institutions and Corporations. Retrieved May 5, 2020.","url":"https://web.archive.org/web/20190625182633if_/https://ti.360.net/blog/articles/apt-c-36-continuous-attacks-targeting-colombian-government-institutions-and-corporations-en/"}]},{"id":"S0445","name":"ShimRatReporter","url":"https://attack.mitre.org/software/S0445","kind":"tool","description":"[ShimRatReporter](https://attack.mitre.org/software/S0445) encrypted gathered information with a combination of shifting and XOR using a static key.(Citation: FOX-IT May 2016 Mofang)","relationship_id":"relationship--ed1cb231-7e2d-461c-a9c8-56a2d1f43c0f","references":[{"source_name":"FOX-IT May 2016 Mofang","description":"Yonathan Klijnsma. (2016, May 17). Mofang: A politically motivated information stealing adversary. Retrieved May 12, 2020.","url":"https://foxitsecurity.files.wordpress.com/2016/06/fox-it_mofang_threatreport_tlp-white.pdf"}]},{"id":"S0446","name":"Ryuk","url":"https://attack.mitre.org/software/S0446","kind":"malware","description":"[Ryuk](https://attack.mitre.org/software/S0446) can use anti-disassembly and code transformation obfuscation techniques.(Citation: CrowdStrike Wizard Spider October 2020)","relationship_id":"relationship--06f16826-1100-4958-86e3-784a22998060","references":[{"source_name":"CrowdStrike Wizard Spider October 2020","description":"Podlosky, A., Hanel, A. et al. (2020, October 16). WIZARD SPIDER Update: Resilient, Reactive and Resolute. Retrieved June 15, 2021.","url":"https://www.crowdstrike.com/blog/wizard-spider-adversary-update/"}]},{"id":"S0447","name":"Lokibot","url":"https://attack.mitre.org/software/S0447","kind":"malware","description":"[Lokibot](https://attack.mitre.org/software/S0447) has obfuscated strings with base64 encoding.(Citation: Infoblox Lokibot January 2019)","relationship_id":"relationship--0dd73de5-d615-4455-a552-ff382ec75e82","references":[{"source_name":"Infoblox Lokibot January 2019","description":"Hoang, M. (2019, January 31). Malicious Activity Report: Elements of  Lokibot Infostealer. Retrieved May 15, 2020.","url":"https://insights.infoblox.com/threat-intelligence-reports/threat-intelligence--22"}]},{"id":"S0449","name":"Maze","url":"https://attack.mitre.org/software/S0449","kind":"malware","description":"[Maze](https://attack.mitre.org/software/S0449) has decrypted strings and other important information during the encryption process. [Maze](https://attack.mitre.org/software/S0449) also calls certain functions dynamically to hinder analysis.(Citation: McAfee Maze March 2020)\t","relationship_id":"relationship--e3864ffa-3348-4791-b979-7d8b2e2151cc","references":[{"source_name":"McAfee Maze March 2020","description":"Mundo, A. (2020, March 26). Ransomware Maze. Retrieved May 18, 2020.","url":"https://www.mcafee.com/blogs/other-blogs/mcafee-labs/ransomware-maze/"}]},{"id":"S0458","name":"Ramsay","url":"https://attack.mitre.org/software/S0458","kind":"malware","description":"[Ramsay](https://attack.mitre.org/software/S0458) has base64-encoded its portable executable and hidden itself under a JPG header. [Ramsay](https://attack.mitre.org/software/S0458) can also embed information within document footers.(Citation: Eset Ramsay May 2020)\t","relationship_id":"relationship--e273286f-8ca7-4d3e-bdc3-08929c7cbd12","references":[{"source_name":"Eset Ramsay May 2020","description":"Sanmillan, I.. (2020, May 13). Ramsay: A cyber‑espionage toolkit tailored for air‑gapped networks. Retrieved May 27, 2020.","url":"https://www.welivesecurity.com/2020/05/13/ramsay-cyberespionage-toolkit-airgapped-networks/"}]},{"id":"S0461","name":"SDBbot","url":"https://attack.mitre.org/software/S0461","kind":"malware","description":"[SDBbot](https://attack.mitre.org/software/S0461) has the ability to XOR the strings for its installer component with a hardcoded 128 byte key.(Citation: Proofpoint TA505 October 2019)","relationship_id":"relationship--f252d0e6-019a-4711-9069-c16930236aa4","references":[{"source_name":"Proofpoint TA505 October 2019","description":"Schwarz, D. et al. (2019, October 16). TA505 Distributes New SDBbot Remote Access Trojan with Get2 Downloader. Retrieved May 29, 2020.","url":"https://www.proofpoint.com/us/threat-insight/post/ta505-distributes-new-sdbbot-remote-access-trojan-get2-downloader"}]},{"id":"S0465","name":"CARROTBALL","url":"https://attack.mitre.org/software/S0465","kind":"tool","description":"[CARROTBALL](https://attack.mitre.org/software/S0465) has used a custom base64 alphabet to decode files.(Citation: Unit 42 CARROTBAT January 2020)","relationship_id":"relationship--d8557c07-240a-4dbb-b372-1111a05a5303","references":[{"source_name":"Unit 42 CARROTBAT January 2020","description":"McCabe, A. (2020, January 23). The Fractured Statue Campaign: U.S. Government Agency Targeted in Spear-Phishing Attacks. Retrieved June 2, 2020.","url":"https://unit42.paloaltonetworks.com/the-fractured-statue-campaign-u-s-government-targeted-in-spear-phishing-attacks/"}]},{"id":"S0467","name":"TajMahal","url":"https://attack.mitre.org/software/S0467","kind":"malware","description":"[TajMahal](https://attack.mitre.org/software/S0467) has used an encrypted Virtual File System to store plugins.(Citation: Kaspersky TajMahal April 2019)","relationship_id":"relationship--f43dedfa-261d-41af-bb74-e1f2eff5cbae","references":[{"source_name":"Kaspersky TajMahal April 2019","description":"GReAT. (2019, April 10). Project TajMahal – a sophisticated new APT framework. Retrieved October 14, 2019.","url":"https://securelist.com/project-tajmahal/90240/"}]},{"id":"S0476","name":"Valak","url":"https://attack.mitre.org/software/S0476","kind":"malware","description":"[Valak](https://attack.mitre.org/software/S0476) has the ability to base64 encode and XOR encrypt strings.(Citation: Cybereason Valak May 2020)(Citation: Unit 42 Valak July 2020)(Citation: SentinelOne Valak June 2020)","relationship_id":"relationship--25b8b66a-a9d0-4400-8b41-dd12208a25de","references":[{"source_name":"Unit 42 Valak July 2020","description":"Duncan, B. (2020, July 24). Evolution of Valak, from Its Beginnings to Mass Distribution. Retrieved August 31, 2020.","url":"https://unit42.paloaltonetworks.com/valak-evolution/"},{"source_name":"SentinelOne Valak June 2020","description":"Reaves, J. and Platt, J. (2020, June). Valak Malware and the Connection to Gozi Loader ConfCrew. Retrieved August 31, 2020.","url":"https://assets.sentinelone.com/labs/sentinel-one-valak-i"},{"source_name":"Cybereason Valak May 2020","description":"Salem, E. et al. (2020, May 28). VALAK: MORE THAN MEETS THE EYE . Retrieved June 19, 2020.","url":"https://www.cybereason.com/blog/valak-more-than-meets-the-eye"}]},{"id":"S0482","name":"Bundlore","url":"https://attack.mitre.org/software/S0482","kind":"malware","description":"[Bundlore](https://attack.mitre.org/software/S0482) has obfuscated data with base64, AES, RC4, and bz2.(Citation: MacKeeper Bundlore Apr 2019)","relationship_id":"relationship--885c54e7-6b1c-4399-a051-1e0b047d6f92","references":[{"source_name":"MacKeeper Bundlore Apr 2019","description":"Sushko, O. (2019, April 17). macOS Bundlore: Mac Virus Bypassing macOS Security Features. Retrieved June 30, 2020.","url":"https://mackeeper.com/blog/post/610-macos-bundlore-adware-analysis/"}]},{"id":"S0499","name":"Hancitor","url":"https://attack.mitre.org/software/S0499","kind":"malware","description":"[Hancitor](https://attack.mitre.org/software/S0499) has used Base64 to encode malicious links.(Citation: Threatpost Hancitor)","relationship_id":"relationship--c8fb4459-4352-4ee6-bfaf-a97be333bf64","references":[{"source_name":"Threatpost Hancitor","description":"Tom Spring. (2017, January 11). Spammers Revive Hancitor Downloader Campaigns. Retrieved August 13, 2020.","url":"https://threatpost.com/spammers-revive-hancitor-downloader-campaigns/123011/"}]},{"id":"S0500","name":"MCMD","url":"https://attack.mitre.org/software/S0500","kind":"tool","description":"[MCMD](https://attack.mitre.org/software/S0500) can Base64 encode output strings prior to sending to C2.(Citation: Secureworks MCMD July 2019)","relationship_id":"relationship--aefb92ff-56e9-47d9-adc9-ed504f271863","references":[{"source_name":"Secureworks MCMD July 2019","description":"Secureworks. (2019, July 24). MCMD Malware Analysis. Retrieved August 13, 2020.","url":"https://www.secureworks.com/research/mcmd-malware-analysis"}]},{"id":"S0502","name":"Drovorub","url":"https://attack.mitre.org/software/S0502","kind":"malware","description":"[Drovorub](https://attack.mitre.org/software/S0502) has used XOR encrypted payloads in WebSocket client to server messages.(Citation: NSA/FBI Drovorub August 2020)","relationship_id":"relationship--20196489-8426-4cb7-a8f0-ca51bef7a385","references":[{"source_name":"NSA/FBI Drovorub August 2020","description":"NSA/FBI. (2020, August). Russian GRU 85th GTsSS Deploys Previously Undisclosed Drovorub Malware. Retrieved August 25, 2020.","url":"https://media.defense.gov/2020/Aug/13/2002476465/-1/-1/0/CSA_DROVORUB_RUSSIAN_GRU_MALWARE_AUG_2020.PDF"}]},{"id":"S0504","name":"Anchor","url":"https://attack.mitre.org/software/S0504","kind":"malware","description":"[Anchor](https://attack.mitre.org/software/S0504) has obfuscated code with stack strings and string encryption.(Citation: Cyberreason Anchor December 2019)","relationship_id":"relationship--9297d0b8-3a96-4fb9-90f2-8e3aa9fe4aca","references":[{"source_name":"Cyberreason Anchor December 2019","description":"Dahan, A. et al. (2019, December 11). DROPPING ANCHOR: FROM A TRICKBOT INFECTION TO THE DISCOVERY OF THE ANCHOR MALWARE. Retrieved September 10, 2020.","url":"https://www.cybereason.com/blog/dropping-anchor-from-a-trickbot-infection-to-the-discovery-of-the-anchor-malware"}]},{"id":"S0511","name":"RegDuke","url":"https://attack.mitre.org/software/S0511","kind":"malware","description":"[RegDuke](https://attack.mitre.org/software/S0511) can use control-flow flattening or the commercially available .NET Reactor for obfuscation.(Citation: ESET Dukes October 2019)","relationship_id":"relationship--c1b912a1-ffb4-4b33-88ec-6a567a1fcfd4","references":[{"source_name":"ESET Dukes October 2019","description":"Faou, M., Tartare, M., Dupuy, T. (2019, October). OPERATION GHOST. Retrieved September 23, 2020.","url":"https://www.welivesecurity.com/wp-content/uploads/2019/10/ESET_Operation_Ghost_Dukes.pdf"}]},{"id":"S0512","name":"FatDuke","url":"https://attack.mitre.org/software/S0512","kind":"malware","description":"[FatDuke](https://attack.mitre.org/software/S0512) can use base64 encoding, string stacking, and opaque predicates for obfuscation.(Citation: ESET Dukes October 2019)","relationship_id":"relationship--7b17bab3-6c5a-4db2-969b-7724f71afc09","references":[{"source_name":"ESET Dukes October 2019","description":"Faou, M., Tartare, M., Dupuy, T. (2019, October). OPERATION GHOST. Retrieved September 23, 2020.","url":"https://www.welivesecurity.com/wp-content/uploads/2019/10/ESET_Operation_Ghost_Dukes.pdf"}]},{"id":"S0516","name":"SoreFang","url":"https://attack.mitre.org/software/S0516","kind":"malware","description":"[SoreFang](https://attack.mitre.org/software/S0516) has the ability to encode and RC6 encrypt data sent to C2.(Citation: CISA SoreFang July 2016)","relationship_id":"relationship--c76875e8-006d-493b-880a-332faf28f3ca","references":[{"source_name":"CISA SoreFang July 2016","description":"CISA. (2020, July 16). MAR-10296782-1.v1 – SOREFANG. Retrieved September 29, 2020.","url":"https://us-cert.cisa.gov/ncas/analysis-reports/ar20-198a"}]},{"id":"S0517","name":"Pillowmint","url":"https://attack.mitre.org/software/S0517","kind":"malware","description":"[Pillowmint](https://attack.mitre.org/software/S0517) has obfuscated the AES key used for encryption.(Citation: Trustwave Pillowmint June 2020)\t","relationship_id":"relationship--426db174-3cc4-4f9c-ae34-6398a86ec3bd","references":[{"source_name":"Trustwave Pillowmint June 2020","description":"Trustwave SpiderLabs. (2020, June 22). Pillowmint: FIN7’s Monkey Thief . Retrieved July 27, 2020.","url":"https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/pillowmint-fin7s-monkey-thief/"}]},{"id":"S0518","name":"PolyglotDuke","url":"https://attack.mitre.org/software/S0518","kind":"malware","description":"[PolyglotDuke](https://attack.mitre.org/software/S0518) can custom encrypt strings.(Citation: ESET Dukes October 2019)","relationship_id":"relationship--194d773b-a9b6-43fc-8113-8e120be95c5c","references":[{"source_name":"ESET Dukes October 2019","description":"Faou, M., Tartare, M., Dupuy, T. (2019, October). OPERATION GHOST. Retrieved September 23, 2020.","url":"https://www.welivesecurity.com/wp-content/uploads/2019/10/ESET_Operation_Ghost_Dukes.pdf"}]},{"id":"S0559","name":"SUNBURST","url":"https://attack.mitre.org/software/S0559","kind":"malware","description":"[SUNBURST](https://attack.mitre.org/software/S0559) obfuscated collected system information using a FNV-1a + XOR algorithm.(Citation: FireEye SUNBURST Backdoor December 2020)","relationship_id":"relationship--713fdffc-8955-43d6-b1bd-4515d3ca06a6","references":[{"source_name":"FireEye SUNBURST Backdoor December 2020","description":"FireEye. (2020, December 13). Highly Evasive Attacker Leverages SolarWinds Supply Chain to Compromise Multiple Global Victims With SUNBURST Backdoor. Retrieved January 4, 2021.","url":"https://www.fireeye.com/blog/threat-research/2020/12/evasive-attacker-leverages-solarwinds-supply-chain-compromises-with-sunburst-backdoor.html"}]},{"id":"S0560","name":"TEARDROP","url":"https://attack.mitre.org/software/S0560","kind":"malware","description":"[TEARDROP](https://attack.mitre.org/software/S0560) created and read from a file with a fake JPG header, and its payload was encrypted with a simple rotating XOR cipher.(Citation: FireEye SUNBURST Backdoor December 2020)(Citation: Check Point Sunburst Teardrop December 2020)(Citation: Microsoft Deep Dive Solorigate January 2021)","relationship_id":"relationship--570df7f7-f2d5-4de9-ba74-4adfa99e980f","references":[{"source_name":"FireEye SUNBURST Backdoor December 2020","description":"FireEye. (2020, December 13). Highly Evasive Attacker Leverages SolarWinds Supply Chain to Compromise Multiple Global Victims With SUNBURST Backdoor. Retrieved January 4, 2021.","url":"https://www.fireeye.com/blog/threat-research/2020/12/evasive-attacker-leverages-solarwinds-supply-chain-compromises-with-sunburst-backdoor.html"},{"source_name":"Check Point Sunburst Teardrop December 2020","description":"Check Point Research. (2020, December 22). SUNBURST, TEARDROP and the NetSec New Normal. Retrieved January 6, 2021.","url":"https://research.checkpoint.com/2020/sunburst-teardrop-and-the-netsec-new-normal/"},{"source_name":"Microsoft Deep Dive Solorigate January 2021","description":"MSTIC, CDOC, 365 Defender Research Team. (2021, January 20). Deep dive into the Solorigate second-stage activation: From SUNBURST to TEARDROP and Raindrop . Retrieved January 22, 2021.","url":"https://www.microsoft.com/security/blog/2021/01/20/deep-dive-into-the-solorigate-second-stage-activation-from-sunburst-to-teardrop-and-raindrop/"}]},{"id":"S0562","name":"SUNSPOT","url":"https://attack.mitre.org/software/S0562","kind":"malware","description":"[SUNSPOT](https://attack.mitre.org/software/S0562) encrypted log entries it collected with the stream cipher RC4 using a hard-coded key. It also uses AES128-CBC encrypted blobs for [SUNBURST](https://attack.mitre.org/software/S0559) source code and data extracted from the SolarWinds Orion <MsBuild.exe</code> process.(Citation: CrowdStrike SUNSPOT Implant January 2021)","relationship_id":"relationship--41118997-c45e-4123-be61-1b0c5d456256","references":[{"source_name":"CrowdStrike SUNSPOT Implant January 2021","description":"CrowdStrike Intelligence Team. (2021, January 11). SUNSPOT: An Implant in the Build Process. Retrieved January 11, 2021.","url":"https://www.crowdstrike.com/blog/sunspot-malware-technical-analysis/"}]},{"id":"S0575","name":"Conti","url":"https://attack.mitre.org/software/S0575","kind":"malware","description":"[Conti](https://attack.mitre.org/software/S0575) can use compiler-based obfuscation for its code, encrypt DLLs, and hide Windows API calls.(Citation: CarbonBlack Conti July 2020)(Citation: Cybereason Conti Jan 2021)(Citation: CrowdStrike Wizard Spider October 2020)","relationship_id":"relationship--9cc5bd19-ab08-4eb7-886b-ce55fde60421","references":[{"source_name":"CarbonBlack Conti July 2020","description":"Baskin, B. (2020, July 8). TAU Threat Discovery: Conti Ransomware. Retrieved February 17, 2021.","url":"https://www.carbonblack.com/blog/tau-threat-discovery-conti-ransomware/"},{"source_name":"Cybereason Conti Jan 2021","description":"Rochberger, L. (2021, January 12). Cybereason vs. Conti Ransomware. Retrieved February 17, 2021.","url":"https://www.cybereason.com/blog/cybereason-vs.-conti-ransomware"},{"source_name":"CrowdStrike Wizard Spider October 2020","description":"Podlosky, A., Hanel, A. et al. (2020, October 16). WIZARD SPIDER Update: Resilient, Reactive and Resolute. Retrieved June 15, 2021.","url":"https://www.crowdstrike.com/blog/wizard-spider-adversary-update/"}]},{"id":"S0584","name":"AppleJeus","url":"https://attack.mitre.org/software/S0584","kind":"malware","description":"[AppleJeus](https://attack.mitre.org/software/S0584) has XOR-encrypted collected system information prior to sending to a C2. [AppleJeus](https://attack.mitre.org/software/S0584) has also used the open source ADVObfuscation library for its components.(Citation: CISA AppleJeus Feb 2021)","relationship_id":"relationship--de300ca1-3935-4b44-9b35-e32eee5304f7","references":[{"source_name":"CISA AppleJeus Feb 2021","description":"Cybersecurity and Infrastructure Security Agency. (2021, February 21). AppleJeus: Analysis of North Korea’s Cryptocurrency Malware. Retrieved March 1, 2021.","url":"https://us-cert.cisa.gov/ncas/alerts/aa21-048a"}]},{"id":"S0593","name":"ECCENTRICBANDWAGON","url":"https://attack.mitre.org/software/S0593","kind":"malware","description":"[ECCENTRICBANDWAGON](https://attack.mitre.org/software/S0593) has encrypted strings with RC4.(Citation: CISA EB Aug 2020)","relationship_id":"relationship--1ffbf752-ed3a-47bb-8351-92ed7118dc5d","references":[{"source_name":"CISA EB Aug 2020","description":"Cybersecurity and Infrastructure Security Agency. (2020, August 26). MAR-10301706-1.v1 - North Korean Remote Access Tool: ECCENTRICBANDWAGON. Retrieved March 18, 2021.","url":"https://us-cert.cisa.gov/ncas/analysis-reports/ar20-239a"}]},{"id":"S0594","name":"Out1","url":"https://attack.mitre.org/software/S0594","kind":"tool","description":"[Out1](https://attack.mitre.org/software/S0594) has the ability to encode data.(Citation: Trend Micro Muddy Water March 2021)","relationship_id":"relationship--28c56887-5dbb-4269-b783-8a7f8d4c9204","references":[{"source_name":"Trend Micro Muddy Water March 2021","description":"Peretz, A. and Theck, E. (2021, March 5). Earth Vetala – MuddyWater Continues to Target Organizations in the Middle East. Retrieved March 18, 2021.","url":"https://www.trendmicro.com/en_us/research/21/c/earth-vetala---muddywater-continues-to-target-organizations-in-t.html"}]},{"id":"S0596","name":"ShadowPad","url":"https://attack.mitre.org/software/S0596","kind":"malware","description":"[ShadowPad](https://attack.mitre.org/software/S0596) has encrypted its payload, a virtual file system, and various files.(Citation: Securelist ShadowPad Aug 2017)(Citation: TrendMicro EarthLusca 2022)","relationship_id":"relationship--c0876037-56b6-409c-bda5-7aa5e6091c94","references":[{"source_name":"TrendMicro EarthLusca 2022","description":"Chen, J., et al. (2022). Delving Deep: An Analysis of Earth Lusca’s Operations. Retrieved July 1, 2022.","url":"https://www.trendmicro.com/content/dam/trendmicro/global/en/research/22/a/earth-lusca-employs-sophisticated-infrastructure-varied-tools-and-techniques/technical-brief-delving-deep-an-analysis-of-earth-lusca-operations.pdf"},{"source_name":"Securelist ShadowPad Aug 2017","description":"GReAT. (2017, August 15). ShadowPad in corporate networks. Retrieved March 22, 2021.","url":"https://securelist.com/shadowpad-in-corporate-networks/81432/"}]},{"id":"S0598","name":"P.A.S. Webshell","url":"https://attack.mitre.org/software/S0598","kind":"malware","description":"[P.A.S. Webshell](https://attack.mitre.org/software/S0598) can use encryption and base64 encoding to hide strings and to enforce access control once deployed.(Citation: ANSSI Sandworm January 2021)","relationship_id":"relationship--8c73e0be-f105-4f22-93b4-cb765fb8f419","references":[{"source_name":"ANSSI Sandworm January 2021","description":"ANSSI. (2021, January 27). SANDWORM INTRUSION SET CAMPAIGN TARGETING CENTREON SYSTEMS. Retrieved March 30, 2021.","url":"https://www.cert.ssi.gouv.fr/uploads/CERTFR-2021-CTI-005.pdf"}]},{"id":"S0604","name":"Industroyer","url":"https://attack.mitre.org/software/S0604","kind":"malware","description":"[Industroyer](https://attack.mitre.org/software/S0604) uses heavily obfuscated code in its Windows Notepad backdoor.(Citation: ESET Industroyer)","relationship_id":"relationship--fea9df26-2ff4-4fa4-8306-f10af6cdd7cd","references":[{"source_name":"ESET Industroyer","description":"Anton Cherepanov. (2017, June 12). Win32/Industroyer: A new threat for industrial controls systems. Retrieved December 18, 2020.","url":"https://www.welivesecurity.com/wp-content/uploads/2017/06/Win32_Industroyer.pdf"}]},{"id":"S0605","name":"EKANS","url":"https://attack.mitre.org/software/S0605","kind":"malware","description":"[EKANS](https://attack.mitre.org/software/S0605) uses encoded strings in its process kill list.(Citation: FireEye Ransomware Feb 2020) ","relationship_id":"relationship--c17229de-8778-4dd9-adb9-7b9c6bb2b99b","references":[{"source_name":"FireEye Ransomware Feb 2020","description":"Zafra, D., et al. (2020, February 24). Ransomware Against the Machine: How Adversaries are Learning to Disrupt Industrial Production by Targeting IT and OT. Retrieved March 2, 2021.","url":"https://www.fireeye.com/blog/threat-research/2020/02/ransomware-against-machine-learning-to-disrupt-industrial-production.html"}]},{"id":"S0607","name":"KillDisk","url":"https://attack.mitre.org/software/S0607","kind":"malware","description":"[KillDisk](https://attack.mitre.org/software/S0607) uses VMProtect to make reverse engineering the malware more difficult.(Citation: Trend Micro KillDisk 1)","relationship_id":"relationship--89567fdb-433a-4821-85bb-a4a9f55cfef5","references":[{"source_name":"Trend Micro KillDisk 1","description":"Fernando Merces, Byron Gelera, Martin Co. (2018, June 7). KillDisk Variant Hits Latin American Finance Industry. Retrieved January 12, 2021.","url":"https://www.trendmicro.com/en_us/research/18/f/new-killdisk-variant-hits-latin-american-financial-organizations-again.html"}]},{"id":"S0608","name":"Conficker","url":"https://attack.mitre.org/software/S0608","kind":"malware","description":"[Conficker](https://attack.mitre.org/software/S0608) has obfuscated its code to prevent its removal from host machines.(Citation: Trend Micro Conficker)","relationship_id":"relationship--b9de1f4c-1978-4efe-9bd0-f525b6acaeb1","references":[{"source_name":"Trend Micro Conficker","description":"Trend Micro. (2014, March 18). Conficker. Retrieved February 18, 2021.","url":"https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/conficker"}]},{"id":"S0615","name":"SombRAT","url":"https://attack.mitre.org/software/S0615","kind":"malware","description":"[SombRAT](https://attack.mitre.org/software/S0615) can encrypt strings with XOR-based routines and use a custom AES storage format for plugins, configuration, C2 domains, and harvested data.(Citation: BlackBerry CostaRicto November 2020)(Citation: FireEye FiveHands April 2021)(Citation: CISA AR21-126A FIVEHANDS May 2021)","relationship_id":"relationship--4a79cc78-872f-49f0-80c5-20f1b2dcd9f2","references":[{"source_name":"BlackBerry CostaRicto November 2020","description":"The BlackBerry Research and Intelligence Team. (2020, November 12). The CostaRicto Campaign: Cyber-Espionage Outsourced. Retrieved May 24, 2021.","url":"https://blogs.blackberry.com/en/2020/11/the-costaricto-campaign-cyber-espionage-outsourced"},{"source_name":"FireEye FiveHands April 2021","description":"McLellan, T.  and Moore, J. et al. (2021, April 29). UNC2447 SOMBRAT and FIVEHANDS Ransomware: A Sophisticated Financial Threat. Retrieved June 2, 2021.","url":"https://www.fireeye.com/blog/threat-research/2021/04/unc2447-sombrat-and-fivehands-ransomware-sophisticated-financial-threat.html"},{"source_name":"CISA AR21-126A FIVEHANDS May 2021","description":"CISA. (2021, May 6). Analysis Report (AR21-126A) FiveHands Ransomware. Retrieved June 7, 2021.","url":"https://us-cert.cisa.gov/ncas/analysis-reports/ar21-126a"}]},{"id":"S0622","name":"AppleSeed","url":"https://attack.mitre.org/software/S0622","kind":"malware","description":"[AppleSeed](https://attack.mitre.org/software/S0622) has the ability to Base64 encode its payload and custom encrypt API calls.(Citation: Malwarebytes Kimsuky June 2021)","relationship_id":"relationship--b49fe95b-bd40-4dc7-a42c-b5741cde4941","references":[{"source_name":"Malwarebytes Kimsuky June 2021","description":"Jazi, H. (2021, June 1). Kimsuky APT continues to target South Korean government using AppleSeed backdoor. Retrieved June 10, 2021.","url":"https://blog.malwarebytes.com/threat-analysis/2021/06/kimsuky-apt-continues-to-target-south-korean-government-using-appleseed-backdoor/"}]},{"id":"S0623","name":"Siloscape","url":"https://attack.mitre.org/software/S0623","kind":"malware","description":"[Siloscape](https://attack.mitre.org/software/S0623) itself is obfuscated and uses obfuscated API calls.(Citation: Unit 42 Siloscape Jun 2021)","relationship_id":"relationship--bb671992-02f2-430d-9d33-f43fae135735","references":[{"source_name":"Unit 42 Siloscape Jun 2021","description":"Prizmant, D. (2021, June 7). Siloscape: First Known Malware Targeting Windows Containers to Compromise Cloud Environments. Retrieved June 9, 2021.","url":"https://unit42.paloaltonetworks.com/siloscape/"}]},{"id":"S0624","name":"Ecipekac","url":"https://attack.mitre.org/software/S0624","kind":"malware","description":"[Ecipekac](https://attack.mitre.org/software/S0624) can use XOR, AES, and DES to encrypt loader shellcode.(Citation: Securelist APT10 March 2021)","relationship_id":"relationship--6c75071d-6997-4d41-88fa-bcd8d7b4cb76","references":[{"source_name":"Securelist APT10 March 2021","description":"GREAT. (2021, March 30). APT10: sophisticated multi-layered loader Ecipekac discovered in A41APT campaign. Retrieved June 17, 2021.","url":"https://securelist.com/apt10-sophisticated-multi-layered-loader-ecipekac-discovered-in-a41apt-campaign/101519/"}]},{"id":"S0625","name":"Cuba","url":"https://attack.mitre.org/software/S0625","kind":"malware","description":"[Cuba](https://attack.mitre.org/software/S0625) has used multiple layers of obfuscation to avoid analysis, including its Base64 encoded payload.(Citation: McAfee Cuba April 2021) ","relationship_id":"relationship--662f14ec-90c6-48f7-98c6-ba028ca38621","references":[{"source_name":"McAfee Cuba April 2021","description":"Roccio, T., et al. (2021, April). Technical Analysis of Cuba Ransomware. Retrieved June 18, 2021.","url":"https://www.mcafee.com/enterprise/en-us/assets/reports/rp-cuba-ransomware.pdf"}]},{"id":"S0627","name":"SodaMaster","url":"https://attack.mitre.org/software/S0627","kind":"malware","description":"[SodaMaster](https://attack.mitre.org/software/S0627) can use \"stackstrings\" for obfuscation.(Citation: Securelist APT10 March 2021)","relationship_id":"relationship--32035519-2c91-4fc2-a9c4-64c766510374","references":[{"source_name":"Securelist APT10 March 2021","description":"GREAT. (2021, March 30). APT10: sophisticated multi-layered loader Ecipekac discovered in A41APT campaign. Retrieved June 17, 2021.","url":"https://securelist.com/apt10-sophisticated-multi-layered-loader-ecipekac-discovered-in-a41apt-campaign/101519/"}]},{"id":"S0632","name":"GrimAgent","url":"https://attack.mitre.org/software/S0632","kind":"malware","description":"[GrimAgent](https://attack.mitre.org/software/S0632) has used Rotate on Right (RoR) and Rotate on Left (RoL) functionality to encrypt strings.(Citation: Group IB GrimAgent July 2021)","relationship_id":"relationship--ecd6c482-51ae-402c-8482-4feb9cda9b05","references":[{"source_name":"Group IB GrimAgent July 2021","description":"Priego, A. (2021, July). THE BROTHERS GRIM: THE REVERSING TALE OF GRIMAGENT MALWARE USED BY RYUK. Retrieved September 19, 2024.","url":"https://www.group-ib.com/blog/grimagent/"}]},{"id":"S0633","name":"Sliver","url":"https://attack.mitre.org/software/S0633","kind":"tool","description":"[Sliver](https://attack.mitre.org/software/S0633) obfuscates configuration and other static files using native Go libraries such as `garble` and `gobfuscate` to inhibit configuration analysis and static detection.(Citation: Microsoft Sliver 2022)","relationship_id":"relationship--051683e6-0a6a-4a40-bf5d-d2c5f25586e8","references":[{"source_name":"Microsoft Sliver 2022","description":"Microsoft Security Experts. (2022, August 24). Looking for the ‘Sliver’ lining: Hunting for emerging command-and-control frameworks. Retrieved March 24, 2025.","url":"https://www.microsoft.com/en-us/security/blog/2022/08/24/looking-for-the-sliver-lining-hunting-for-emerging-command-and-control-frameworks/"}]},{"id":"S0635","name":"BoomBox","url":"https://attack.mitre.org/software/S0635","kind":"malware","description":"[BoomBox](https://attack.mitre.org/software/S0635) can encrypt data using AES prior to exfiltration.(Citation: MSTIC Nobelium Toolset May 2021)","relationship_id":"relationship--fd79762c-1718-4c6b-adaa-a9a004bcdbca","references":[{"source_name":"MSTIC Nobelium Toolset May 2021","description":"MSTIC. (2021, May 28). Breaking down NOBELIUM’s latest early-stage toolset. Retrieved August 4, 2021.","url":"https://www.microsoft.com/security/blog/2021/05/28/breaking-down-nobeliums-latest-early-stage-toolset/"}]},{"id":"S0640","name":"Avaddon","url":"https://attack.mitre.org/software/S0640","kind":"malware","description":"[Avaddon](https://attack.mitre.org/software/S0640) has used encrypted strings.(Citation: Arxiv Avaddon Feb 2021)","relationship_id":"relationship--cc134d2d-64eb-469a-b8eb-90ea632c0adc","references":[{"source_name":"Arxiv Avaddon Feb 2021","description":"Yuste, J. Pastrana, S. (2021, February 9). Avaddon ransomware: an in-depth analysis and decryption of infected systems. Retrieved August 19, 2021.","url":"https://arxiv.org/pdf/2102.04796.pdf"}]},{"id":"S0641","name":"Kobalos","url":"https://attack.mitre.org/software/S0641","kind":"malware","description":"[Kobalos](https://attack.mitre.org/software/S0641) encrypts all strings using RC4 and bundles all functionality into a single function call.(Citation: ESET Kobalos Feb 2021) ","relationship_id":"relationship--9d11c36e-e738-4d2a-98cf-f5f962a716ea","references":[{"source_name":"ESET Kobalos Feb 2021","description":"M.Leveille, M., Sanmillan, I. (2021, February 2). Kobalos – A complex Linux threat to high performance computing infrastructure. Retrieved August 24, 2021.","url":"https://www.welivesecurity.com/2021/02/02/kobalos-complex-linux-threat-high-performance-computing-infrastructure/"}]},{"id":"S0647","name":"Turian","url":"https://attack.mitre.org/software/S0647","kind":"malware","description":"[Turian](https://attack.mitre.org/software/S0647) can use VMProtect for obfuscation.(Citation: ESET BackdoorDiplomacy Jun 2021)","relationship_id":"relationship--388ebc0a-6839-4b03-959c-766c1893cf64","references":[{"source_name":"ESET BackdoorDiplomacy Jun 2021","description":"Adam Burgher. (2021, June 10). BackdoorDiplomacy: Upgrading from Quarian to Turian. Retrieved September 1, 2021","url":"https://www.welivesecurity.com/2021/06/10/backdoordiplomacy-upgrading-quarian-turian/"}]},{"id":"S0650","name":"QakBot","url":"https://attack.mitre.org/software/S0650","kind":"malware","description":"[QakBot](https://attack.mitre.org/software/S0650) has hidden code within Excel spreadsheets by turning the font color to white and splitting it across multiple cells.(Citation: Cyberint Qakbot May 2021)","relationship_id":"relationship--604fa5ae-0a32-45d7-9b9b-595fb43688b6","references":[{"source_name":"Cyberint Qakbot May 2021","description":"Cyberint. (2021, May 25). Qakbot Banking Trojan. Retrieved September 27, 2021.","url":"https://blog.cyberint.com/qakbot-banking-trojan"}]},{"id":"S0651","name":"BoxCaon","url":"https://attack.mitre.org/software/S0651","kind":"malware","description":"[BoxCaon](https://attack.mitre.org/software/S0651) used the \"StackStrings\" obfuscation technique to hide malicious functionalities.(Citation: Checkpoint IndigoZebra July 2021)","relationship_id":"relationship--b6bfd59b-086e-4559-9bc0-159945c84e78","references":[{"source_name":"Checkpoint IndigoZebra July 2021","description":"CheckPoint Research. (2021, July 1). IndigoZebra APT continues to attack Central Asia with evolving tools. Retrieved September 24, 2021.","url":"https://research.checkpoint.com/2021/indigozebra-apt-continues-to-attack-central-asia-with-evolving-tools/"}]},{"id":"S0659","name":"Diavol","url":"https://attack.mitre.org/software/S0659","kind":"malware","description":"[Diavol](https://attack.mitre.org/software/S0659) has Base64 encoded the RSA public key used for encrypting files.(Citation: Fortinet Diavol July 2021)","relationship_id":"relationship--ac6100b4-8a41-4353-8cbf-46e596d8d212","references":[{"source_name":"Fortinet Diavol July 2021","description":"Neeamni, D., Rubinfeld, A.. (2021, July 1). Diavol - A New Ransomware Used By Wizard Spider?. Retrieved November 12, 2021.","url":"https://www.fortinet.com/blog/threat-research/diavol-new-ransomware-used-by-wizard-spider"}]},{"id":"S0660","name":"Clambling","url":"https://attack.mitre.org/software/S0660","kind":"malware","description":"The [Clambling](https://attack.mitre.org/software/S0660) executable has been obfuscated when dropped on a compromised host.(Citation: Trend Micro DRBControl February 2020)","relationship_id":"relationship--57c72f80-38bf-48b4-9f5d-eefef4025e34","references":[{"source_name":"Trend Micro DRBControl February 2020","description":"Lunghi, D. et al. (2020, February). Uncovering DRBControl. Retrieved November 12, 2021.","url":"https://documents.trendmicro.com/assets/white_papers/wp-uncovering-DRBcontrol.pdf"}]},{"id":"S0681","name":"Lizar","url":"https://attack.mitre.org/software/S0681","kind":"malware","description":"[Lizar](https://attack.mitre.org/software/S0681) has obfuscated the fingerprint of the victim system, the local IP address, and the Fowler-Noll-V 1 (FNV-1) hash of the local IP address using an XOR operation. The data is then sent to the C2 server.(Citation: SekoiaBourhis_DiceLoader_Feb2024) ","relationship_id":"relationship--451a9d37-4e16-4822-85db-821b1dd49ddc","references":[{"source_name":"SekoiaBourhis_DiceLoader_Feb2024","description":"Bourhis, P., Sekoia TDR. (2024, February 1). Unveiling the intricacies of DiceLoader. Retrieved May 14, 2025.","url":"https://blog.sekoia.io/unveiling-the-intricacies-of-diceloader/"}]},{"id":"S0690","name":"Green Lambert","url":"https://attack.mitre.org/software/S0690","kind":"malware","description":"[Green Lambert](https://attack.mitre.org/software/S0690) has encrypted strings.(Citation: Objective See Green Lambert for OSX Oct 2021)(Citation: Glitch-Cat Green Lambert ATTCK Oct 2021) ","relationship_id":"relationship--a7361e2b-9cdc-4fa6-97e4-1b191e9f3952","references":[{"source_name":"Objective See Green Lambert for OSX Oct 2021","description":"Sandvik, Runa. (2021, October 1). Made In America: Green Lambert for OS X. Retrieved March 21, 2022.","url":"https://objective-see.com/blog/blog_0x68.html"},{"source_name":"Glitch-Cat Green Lambert ATTCK Oct 2021","description":"Sandvik, Runa. (2021, October 18). Green Lambert and ATT&CK. Retrieved November 17, 2024.","url":"https://web.archive.org/web/20211018145402/https://www.glitch-cat.com/blog/green-lambert-and-attack"}]},{"id":"S0694","name":"DRATzarus","url":"https://attack.mitre.org/software/S0694","kind":"malware","description":"[DRATzarus](https://attack.mitre.org/software/S0694) can be partly encrypted with XOR.(Citation: ClearSky Lazarus Aug 2020)","relationship_id":"relationship--def1a889-9341-4179-9d14-a5c10aa100b2","references":[{"source_name":"ClearSky Lazarus Aug 2020","description":"ClearSky Research Team. (2020, August 13). Operation 'Dream Job' Widespread North Korean Espionage Campaign. Retrieved December 20, 2021.","url":"https://www.clearskysec.com/wp-content/uploads/2020/08/Dream-Job-Campaign.pdf"}]},{"id":"S0696","name":"Flagpro","url":"https://attack.mitre.org/software/S0696","kind":"malware","description":"[Flagpro](https://attack.mitre.org/software/S0696) has been delivered within ZIP or RAR password-protected archived files.(Citation: NTT Security Flagpro new December 2021)","relationship_id":"relationship--6610cf22-0a8c-4c30-bc6f-817b8cf29e61","references":[{"source_name":"NTT Security Flagpro new December 2021","description":"Hada, H. (2021, December 28).  Flagpro The new malware used by BlackTech. Retrieved March 25, 2022.","url":"https://insight-jp.nttsecurity.com/post/102hf3q/flagpro-the-new-malware-used-by-blacktech"}]},{"id":"S1018","name":"Saint Bot","url":"https://attack.mitre.org/software/S1018","kind":"malware","description":"[Saint Bot](https://attack.mitre.org/software/S1018) has been obfuscated to help avoid detection.(Citation: Palo Alto Unit 42 OutSteel SaintBot February 2022 )","relationship_id":"relationship--2e8b176a-b8a8-4bd0-8542-97ff009c673c","references":[{"source_name":"Palo Alto Unit 42 OutSteel SaintBot February 2022 ","description":"Unit 42. (2022, February 25). Spear Phishing Attacks Target Organizations in Ukraine, Payloads Include the Document Stealer OutSteel and the Downloader SaintBot. Retrieved June 9, 2022.","url":"https://unit42.paloaltonetworks.com/ukraine-targeted-outsteel-saintbot/"}]},{"id":"S1025","name":"Amadey","url":"https://attack.mitre.org/software/S1025","kind":"malware","description":"[Amadey](https://attack.mitre.org/software/S1025) has obfuscated strings such as antivirus vendor names, domains, files, and others.(Citation: BlackBerry Amadey 2020)","relationship_id":"relationship--1793516c-a4dd-4726-9bb3-c3b2bbecc605","references":[{"source_name":"BlackBerry Amadey 2020","description":"Kasuya, M. (2020, January 8). Threat Spotlight: Amadey Bot Targets Non-Russian Users. Retrieved July 14, 2022.","url":"https://blogs.blackberry.com/en/2020/01/threat-spotlight-amadey-bot"}]},{"id":"S1028","name":"Action RAT","url":"https://attack.mitre.org/software/S1028","kind":"malware","description":" [Action RAT](https://attack.mitre.org/software/S1028)'s commands, strings, and domains can be Base64 encoded within the payload.(Citation: MalwareBytes SideCopy Dec 2021)","relationship_id":"relationship--7d8a48be-2429-401f-b963-ec0f5927a282","references":[{"source_name":"MalwareBytes SideCopy Dec 2021","description":"Threat Intelligence Team. (2021, December 2). SideCopy APT: Connecting lures victims, payloads to infrastructure. Retrieved June 13, 2022.","url":"https://www.malwarebytes.com/blog/news/2021/12/sidecopy-apt-connecting-lures-to-victims-payloads-to-infrastructure"}]},{"id":"S1035","name":"Small Sieve","url":"https://attack.mitre.org/software/S1035","kind":"malware","description":"[Small Sieve](https://attack.mitre.org/software/S1035) has the ability to use a custom hex byte swapping encoding scheme combined with an obfuscated Base64 function to protect program strings and Telegram credentials.(Citation: NCSC GCHQ Small Sieve Jan 2022)","relationship_id":"relationship--7dfc877a-4563-4c7f-91e0-b5f5adfcb873","references":[{"source_name":"NCSC GCHQ Small Sieve Jan 2022","description":"NCSC GCHQ. (2022, January 27). Small Sieve Malware Analysis Report. Retrieved August 22, 2022.","url":"https://www.ncsc.gov.uk/files/NCSC-Malware-Analysis-Report-Small-Sieve.pdf"}]},{"id":"S1039","name":"Bumblebee","url":"https://attack.mitre.org/software/S1039","kind":"malware","description":"[Bumblebee](https://attack.mitre.org/software/S1039) has been delivered as password-protected zipped ISO files and used control-flow-flattening to obfuscate the flow of functions.(Citation: Proofpoint Bumblebee April 2022)(Citation: Cybereason Bumblebee August 2022)(Citation: Medium Ali Salem Bumblebee April 2022)","relationship_id":"relationship--a0040bac-4445-4999-bf0f-53b340f02218","references":[{"source_name":"Cybereason Bumblebee August 2022","description":"Cybereason. (2022, August 17). Bumblebee Loader – The High Road to Enterprise Domain Control. Retrieved August 29, 2022.","url":"https://www.cybereason.com/blog/threat-analysis-report-bumblebee-loader-the-high-road-to-enterprise-domain-control"},{"source_name":"Proofpoint Bumblebee April 2022","description":"Merriman, K. and Trouerbach, P. (2022, April 28). This isn't Optimus Prime's Bumblebee but it's Still Transforming. Retrieved August 22, 2022.","url":"https://www.proofpoint.com/us/blog/threat-insight/bumblebee-is-still-transforming"},{"source_name":"Medium Ali Salem Bumblebee April 2022","description":"Salem, A. (2022, April 27). The chronicles of Bumblebee: The Hook, the Bee, and the Trickbot connection. Retrieved September 2, 2022.","url":"https://elis531989.medium.com/the-chronicles-of-bumblebee-the-hook-the-bee-and-the-trickbot-connection-686379311056"}]},{"id":"S1053","name":"AvosLocker","url":"https://attack.mitre.org/software/S1053","kind":"malware","description":"[AvosLocker](https://attack.mitre.org/software/S1053) has used XOR-encoded strings.(Citation: Malwarebytes AvosLocker Jul 2021)","relationship_id":"relationship--e12155de-d422-47e4-9ce5-a7fe8011b74b","references":[{"source_name":"Malwarebytes AvosLocker Jul 2021","description":"Hasherezade. (2021, July 23). AvosLocker enters the ransomware scene, asks for partners. Retrieved January 11, 2023.","url":"https://www.malwarebytes.com/blog/threat-intelligence/2021/07/avoslocker-enters-the-ransomware-scene-asks-for-partners"}]},{"id":"S1063","name":"Brute Ratel C4","url":"https://attack.mitre.org/software/S1063","kind":"tool","description":"[Brute Ratel C4](https://attack.mitre.org/software/S1063) has used encrypted payload files and maintains an encrypted configuration structure in memory.(Citation: Palo Alto Brute Ratel July 2022)(Citation: MDSec Brute Ratel August 2022)","relationship_id":"relationship--58d4910f-9d51-4961-84eb-9ef0ee2e8bc3","references":[{"source_name":"MDSec Brute Ratel August 2022","description":"Chell, D.  PART 3: How I Met Your Beacon – Brute Ratel. Retrieved February 6, 2023.","url":"https://www.mdsec.co.uk/2022/08/part-3-how-i-met-your-beacon-brute-ratel/"},{"source_name":"Palo Alto Brute Ratel July 2022","description":"Harbison, M. and Renals, P. (2022, July 5). When Pentest Tools Go Brutal: Red-Teaming Tool Being Abused by Malicious Actors. Retrieved February 1, 2023.","url":"https://unit42.paloaltonetworks.com/brute-ratel-c4-tool/"}]},{"id":"S1064","name":"SVCReady","url":"https://attack.mitre.org/software/S1064","kind":"malware","description":"[SVCReady](https://attack.mitre.org/software/S1064) can encrypt victim data with an RC4 cipher.(Citation: HP SVCReady Jun 2022)","relationship_id":"relationship--1098fd1c-b615-4730-bc99-3cda386f2e4c","references":[{"source_name":"HP SVCReady Jun 2022","description":"Schlapfer, Patrick. (2022, June 6). A New Loader Gets Ready. Retrieved December 13, 2022.","url":"https://threatresearch.ext.hp.com/svcready-a-new-loader-reveals-itself/"}]},{"id":"S1066","name":"DarkTortilla","url":"https://attack.mitre.org/software/S1066","kind":"malware","description":"[DarkTortilla](https://attack.mitre.org/software/S1066) has been obfuscated with the DeepSea .NET and ConfuserEx code obfuscators.(Citation: Secureworks DarkTortilla Aug 2022)","relationship_id":"relationship--0b58e2e5-9be5-4132-a65f-19db8acd7033","references":[{"source_name":"Secureworks DarkTortilla Aug 2022","description":"Secureworks Counter Threat Unit Research Team. (2022, August 17). DarkTortilla Malware Analysis. Retrieved November 3, 2022.","url":"https://www.secureworks.com/research/darktortilla-malware-analysis"}]},{"id":"S1085","name":"Sardonic","url":"https://attack.mitre.org/software/S1085","kind":"malware","description":"[Sardonic](https://attack.mitre.org/software/S1085) can use certain ConfuserEx features for obfuscation and can be encoded in a base64 string.(Citation: Symantec FIN8 Jul 2023)","relationship_id":"relationship--d93b7c7b-e4b2-416c-9122-6f687642ce6e","references":[{"source_name":"Symantec FIN8 Jul 2023","description":"Symantec Threat Hunter Team. (2023, July 18). FIN8 Uses Revamped Sardonic Backdoor to Deliver Noberus Ransomware. Retrieved August 9, 2023.","url":"https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/syssphinx-fin8-backdoor"}]},{"id":"S1086","name":"Snip3","url":"https://attack.mitre.org/software/S1086","kind":"malware","description":"[Snip3](https://attack.mitre.org/software/S1086) has the ability to obfuscate strings using XOR encryption.(Citation: Morphisec Snip3 May 2021)","relationship_id":"relationship--3979ca39-09a1-4a2b-a7d3-2eca5f1fb166","references":[{"source_name":"Morphisec Snip3 May 2021","description":"Lorber, N. (2021, May 7). Revealing the Snip3 Crypter, a Highly Evasive RAT Loader. Retrieved September 13, 2023.","url":"https://blog.morphisec.com/revealing-the-snip3-crypter-a-highly-evasive-rat-loader"}]},{"id":"S1090","name":"NightClub","url":"https://attack.mitre.org/software/S1090","kind":"malware","description":"[NightClub](https://attack.mitre.org/software/S1090) can obfuscate strings using the congruential generator `(LCG): staten+1 = (690069 × staten + 1) mod 232`.(Citation: MoustachedBouncer ESET August 2023)\n","relationship_id":"relationship--c1dddcf3-c3b1-498a-9a80-8dcbf6887d10","references":[{"source_name":"MoustachedBouncer ESET August 2023","description":"Faou, M. (2023, August 10). MoustachedBouncer: Espionage against foreign diplomats in Belarus. Retrieved September 25, 2023.","url":"https://www.welivesecurity.com/en/eset-research/moustachedbouncer-espionage-against-foreign-diplomats-in-belarus/"}]},{"id":"S1099","name":"Samurai","url":"https://attack.mitre.org/software/S1099","kind":"malware","description":"[Samurai](https://attack.mitre.org/software/S1099) can encrypt the names of requested APIs.(Citation: Kaspersky ToddyCat June 2022)","relationship_id":"relationship--f785ff3b-923c-478e-a194-c13c6bdbf071","references":[{"source_name":"Kaspersky ToddyCat June 2022","description":"Dedola, G. (2022, June 21). APT ToddyCat. Retrieved January 3, 2024.","url":"https://securelist.com/toddycat/106799/"}]},{"id":"S1104","name":"SLOWPULSE","url":"https://attack.mitre.org/software/S1104","kind":"malware","description":"[SLOWPULSE](https://attack.mitre.org/software/S1104) can hide malicious code in the padding regions between legitimate functions in the Pulse Secure `libdsplibs.so` file.(Citation: Mandiant Pulse Secure Zero-Day April 2021)","relationship_id":"relationship--f35fa774-0344-4678-b104-a0dd1003197a","references":[{"source_name":"Mandiant Pulse Secure Zero-Day April 2021","description":"Perez, D. et al. (2021, April 20). Check Your Pulse: Suspected APT Actors Leverage Authentication Bypass Techniques and Pulse Secure Zero-Day. Retrieved February 5, 2024.","url":"https://www.mandiant.com/resources/blog/suspected-apt-actors-leverage-bypass-techniques-pulse-secure-zero-day"}]},{"id":"S1105","name":"COATHANGER","url":"https://attack.mitre.org/software/S1105","kind":"malware","description":"[COATHANGER](https://attack.mitre.org/software/S1105) can store obfuscated configuration information in the last 56 bytes of the file `/date/.bd.key/preload.so`.(Citation: NCSC-NL COATHANGER Feb 2024)","relationship_id":"relationship--e3602962-691a-4a34-a49b-4682405da8ad","references":[{"source_name":"NCSC-NL COATHANGER Feb 2024","description":"Dutch Military Intelligence and Security Service (MIVD) & Dutch General Intelligence and Security Service (AIVD). (2024, February 6). Ministry of Defense of the Netherlands uncovers COATHANGER, a stealthy Chinese FortiGate RAT. Retrieved February 7, 2024.","url":"https://www.ncsc.nl/binaries/ncsc/documenten/publicaties/2024/februari/6/mivd-aivd-advisory-coathanger-tlp-clear/TLP-CLEAR+MIVD+AIVD+Advisory+COATHANGER.pdf"}]},{"id":"S1111","name":"DarkGate","url":"https://attack.mitre.org/software/S1111","kind":"malware","description":"[DarkGate](https://attack.mitre.org/software/S1111) uses a hard-coded string as a seed, along with the victim machine hardware identifier and input text, to generate a unique string used as an internal mutex value to evade static detection based on mutexes.(Citation: Trellix Darkgate 2023)","relationship_id":"relationship--624b57dc-3cae-45c7-8473-c5116df57697","references":[{"source_name":"Trellix Darkgate 2023","description":"Ernesto Fernández Provecho, Pham Duy Phuc, Ciana Driscoll & Vinoo Thomas. (2023, November 21). The Continued Evolution of the DarkGate Malware-as-a-Service. Retrieved February 9, 2024.","url":"https://www.trellix.com/blogs/research/the-continued-evolution-of-the-darkgate-malware-as-a-service/"}]},{"id":"S1118","name":"BUSHWALK","url":"https://attack.mitre.org/software/S1118","kind":"malware","description":"[BUSHWALK](https://attack.mitre.org/software/S1118) can encrypt the resulting data generated from C2 commands with RC4.(Citation: Mandiant Cutting Edge Part 2 January 2024)","relationship_id":"relationship--fce01f90-b298-4a34-8c15-0a84c351ba19","references":[{"source_name":"Mandiant Cutting Edge Part 2 January 2024","description":"Lin, M. et al. (2024, January 31). Cutting Edge, Part 2: Investigating Ivanti Connect Secure VPN Zero-Day Exploitation. Retrieved February 27, 2024.","url":"https://www.mandiant.com/resources/blog/investigating-ivanti-zero-day-exploitation"}]},{"id":"S1130","name":"Raspberry Robin","url":"https://attack.mitre.org/software/S1130","kind":"malware","description":"[Raspberry Robin](https://attack.mitre.org/software/S1130) uses mixed-case letters for filenames and commands to evade detection.(Citation: RedCanary RaspberryRobin 2022)","relationship_id":"relationship--d99149ea-7a52-455c-a56d-1f78a727a846","references":[{"source_name":"RedCanary RaspberryRobin 2022","description":"Lauren Podber and Stef Rand. (2022, May 5). Raspberry Robin gets the worm early. Retrieved May 17, 2024.","url":"https://redcanary.com/blog/threat-intelligence/raspberry-robin/"}]},{"id":"S1138","name":"Gootloader","url":"https://attack.mitre.org/software/S1138","kind":"malware","description":"\nThe [Gootloader](https://attack.mitre.org/software/S1138) first stage script is obfuscated using random alpha numeric strings.(Citation: Sophos Gootloader)(Citation: SentinelOne Gootloader June 2021)","relationship_id":"relationship--e44f4171-5601-4b92-964a-908af35b98e2","references":[{"source_name":"SentinelOne Gootloader June 2021","description":"Pirozzi, A. (2021, June 16). Gootloader: ‘Initial Access as a Service’ Platform Expands Its Search for High Value Targets. Retrieved May 28, 2024.","url":"https://www.sentinelone.com/labs/gootloader-initial-access-as-a-service-platform-expands-its-search-for-high-value-targets/"},{"source_name":"Sophos Gootloader","description":"Szappanos, G. & Brandt, A. (2021, March 1). “Gootloader” expands its payload delivery options. Retrieved September 30, 2022.","url":"https://news.sophos.com/en-us/2021/03/01/gootloader-expands-its-payload-delivery-options/"}]},{"id":"S1149","name":"CHIMNEYSWEEP","url":"https://attack.mitre.org/software/S1149","kind":"malware","description":"[CHIMNEYSWEEP](https://attack.mitre.org/software/S1149) can use a custom Base64 alphabet to encode an API decryption key.(Citation: Mandiant ROADSWEEP August 2022)","relationship_id":"relationship--1a1fd6b3-bc40-4646-958a-34c35d1b0451","references":[{"source_name":"Mandiant ROADSWEEP August 2022","description":"Jenkins, L. at al. (2022, August 4). ROADSWEEP Ransomware - Likely Iranian Threat Actor Conducts Politically Motivated Disruptive Activity Against Albanian Government Organizations. Retrieved August 6, 2024.","url":"https://cloud.google.com/blog/topics/threat-intelligence/likely-iranian-threat-actor-conducts-politically-motivated-disruptive-activity-against/"}]},{"id":"S1161","name":"BPFDoor","url":"https://attack.mitre.org/software/S1161","kind":"malware","description":"[BPFDoor](https://attack.mitre.org/software/S1161) can require a password to activate the backdoor and uses RC4 encryption or static library encryption `libtomcrypt`.(Citation: Sandfly BPFDoor 2022)","relationship_id":"relationship--bc1c0019-3072-413f-add4-da266e467edf","references":[{"source_name":"Sandfly BPFDoor 2022","description":"The Sandfly Security Team. (2022, May 11). BPFDoor - An Evasive Linux Backdoor Technical Analysis. Retrieved September 29, 2023.","url":"https://sandflysecurity.com/blog/bpfdoor-an-evasive-linux-backdoor-technical-analysis/"}]},{"id":"S1183","name":"StrelaStealer","url":"https://attack.mitre.org/software/S1183","kind":"malware","description":"[StrelaStealer](https://attack.mitre.org/software/S1183) has been distributed in ISO archives.(Citation: DCSO StrelaStealer 2022) [StrelaStealer](https://attack.mitre.org/software/S1183) has been delivered in encrypted, password-protected ZIP archives.(Citation: IBM StrelaStealer 2024)","relationship_id":"relationship--26402760-e6cb-47b7-aabc-8271549e5f22","references":[{"source_name":"DCSO StrelaStealer 2022","description":"DCSO CyTec Blog. (2022, November 8). #ShortAndMalicious: StrelaStealer aims for mail credentials. Retrieved December 31, 2024.","url":"https://medium.com/@DCSO_CyTec/shortandmalicious-strelastealer-aims-for-mail-credentials-a4c3e78c8abc"},{"source_name":"IBM StrelaStealer 2024","description":"Golo Mühr, Joe Fasulo & Charlotte Hammond, IBM X-Force. (2024, November 12). Strela Stealer: Today’s invoice is tomorrow’s phish. Retrieved December 31, 2024.","url":"https://securityintelligence.com/x-force/strela-stealer-todays-invoice-tomorrows-phish/"}]},{"id":"S1213","name":"Lumma Stealer","url":"https://attack.mitre.org/software/S1213","kind":"malware","description":"[Lumma Stealer](https://attack.mitre.org/software/S1213) has used SmartAssembly to obfuscate .NET payloads.(Citation: Fortinet LummaStealer 2024)","relationship_id":"relationship--aa2d7045-fbad-4b5c-a24e-fd904e089875","references":[{"source_name":"Fortinet LummaStealer 2024","description":"Cara Lin, Fortinet. (2024, January 8). Deceptive Cracked Software Spreads Lumma Variant on YouTube. Retrieved March 22, 2025.","url":"https://www.fortinet.com/blog/threat-research/lumma-variant-on-youtube"}]},{"id":"S1226","name":"BOOKWORM","url":"https://attack.mitre.org/software/S1226","kind":"malware","description":"[BOOKWORM](https://attack.mitre.org/software/S1226) has been delivered using self-extracting RAR archives.(Citation: Unit42 Bookworm Nov2015)","relationship_id":"relationship--d0b79bdf-75ba-4133-bab0-2fe21f3ded43","references":[{"source_name":"Unit42 Bookworm Nov2015","description":"Robert Falcone, Mike Scott, Juan Cortes. (2015, November 10). Bookworm Trojan: A Model of Modular Architecture. Retrieved July 21, 2025.","url":"https://unit42.paloaltonetworks.com/bookworm-trojan-a-model-of-modular-architecture/"}]},{"id":"S1228","name":"PUBLOAD","url":"https://attack.mitre.org/software/S1228","kind":"malware","description":"[PUBLOAD](https://attack.mitre.org/software/S1228) has obfuscated DLL names using the ror13AddHash32 algorithm.(Citation: Cisco Talos MUSTANG PANDA PLUGX PUBLOAD MAY 2022)","relationship_id":"relationship--8c9ecd8e-44d6-4e03-84c6-ff6f44b3bc33","references":[{"source_name":"Cisco Talos MUSTANG PANDA PLUGX PUBLOAD MAY 2022","description":"Asheer Malhotra, Jungsoo An, Kendall Mc. (2022, May 5). Mustang Panda deploys a new wave of malware targeting Europe. Retrieved August 4, 2025.","url":"https://blog.talosintelligence.com/mustang-panda-targets-europe/"}]},{"id":"S9007","name":"HTTPTroy","url":"https://attack.mitre.org/software/S9007","kind":"malware","description":"[HTTPTroy](https://attack.mitre.org/software/S9007) has obfuscated strings using Single Instruction Multiple Data (SIMD) instructions to hinder analysis and detection.(Citation: Gen Digital Kimsuky HTTPTroy October 2025)","relationship_id":"relationship--6d5d5bcd-eb2e-47ae-9e8a-0d539b994144","references":[{"source_name":"Gen Digital Kimsuky HTTPTroy October 2025","description":"Alexndru-Cristian Bardas. (2025, October 30). DPRK’s Playbook: Kimsuky’s HttpTroy and Lazarus’s New BLINDINGCAN Variant. Retrieved April 8, 2026.","url":"https://www.gendigital.com/blog/insights/research/dprk-kimsuky-lazarus-analysis"}]},{"id":"S9008","name":"Shai-Hulud","url":"https://attack.mitre.org/software/S9008","kind":"malware","description":"[Shai-Hulud](https://attack.mitre.org/software/S9008) has utilized double-base64 encoding to store stolen secrets within the Github Action Logs within the victim account.(Citation: Aikido Shai-Hulud September 2025)(Citation: Netskope Shai-Hulud November 2025)(Citation: Wiz Shai-Hulud September 2025)(Citation: Socket Shai-Hulud Trufflehog September 2025) [Shai-Hulud](https://attack.mitre.org/software/S9008) has also leveraged three layers of base64 encoding of exfiltrated data for anti-forensic purposes.(Citation: Socket Shai-Hulud November 2025)","relationship_id":"relationship--015b902b-4370-4b55-884a-a6c8d2b15687","references":[{"source_name":"Aikido Shai-Hulud September 2025","description":"Charlie Eriksen. (2025, September 16). S1ngularity/nx attackers strike again. Retrieved April 9, 2026.","url":"https://www.aikido.dev/blog/s1ngularity-nx-attackers-strike-again"},{"source_name":"Netskope Shai-Hulud November 2025","description":"Gianpietro Cutolo. (2025, November 26). Shai-Hulud 2.0: Aggressive, Automated, and Fast Spreading. Retrieved April 9, 2026.","url":"https://www.netskope.com/blog/shai-hulud-2-0-aggressive-automated-one-of-fastest-spreading-npm-supply-chain-attacks-ever-observed"},{"source_name":"Wiz Shai-Hulud September 2025","description":"Merav Bar, Rami McCarthy, Barak Sharoni. (2025, September 16). Shai-Hulud: Ongoing Package Supply Chain Worm Delivering Data-Stealing Malware. Retrieved April 9, 2026.","url":"https://www.wiz.io/blog/shai-hulud-npm-supply-chain-attack"},{"source_name":"Socket Shai-Hulud November 2025","description":"Socket Research Team. (2025, November 24). Shai Hulud Strikes Again (v2). Retrieved April 9, 2026.","url":"https://socket.dev/blog/shai-hulud-strikes-again-v2"},{"source_name":"Socket Shai-Hulud Trufflehog September 2025","description":"Socket Research Team. (2025, September 15). Popular Tinycolor npm Package Compromised in Supply Chain Attack Affecting 40+ Packages. Retrieved April 9, 2026.","url":"https://socket.dev/blog/tinycolor-supply-chain-attack-affects-40-packages"}]},{"id":"S9015","name":"BRICKSTORM","url":"https://attack.mitre.org/software/S9015","kind":"malware","description":"[BRICKSTORM](https://attack.mitre.org/software/S9015) has utilized Go libraries to include Garble to obfuscate code.(Citation: Picus Security BRICKSTORM UNC5221 October 2025)(Citation: Google BRICKSTORM September 2025)","relationship_id":"relationship--130768d0-0f98-4a1b-b4bb-34c5e372cda1","references":[{"source_name":"Picus Security BRICKSTORM UNC5221 October 2025","description":"Huseyin Can Yuceel. (2025, October 1). BRICKSTORM Malware: UNC5221 Targets Tech and Legal Sectors in the United States. Retrieved April 16, 2026.","url":"https://www.picussecurity.com/resource/blog/brickstorm-malware-unc5221-targets-tech-and-legal-sectors-in-the-united-states"},{"source_name":"Google BRICKSTORM September 2025","description":"Sarah Yoder, John Wolfram, Ashley Pearson, Doug Bienstock, Josh Madeley, Josh Murchie, Brad Slaybaugh, Matt Lin, Geoff Carstairs, Austin Larsen. (2025, September 24). Another BRICKSTORM: Stealthy Backdoor Enabling Espionage into Tech and Legal Sectors. Retrieved April 16, 2026.","url":"https://cloud.google.com/blog/topics/threat-intelligence/brickstorm-espionage-campaign"}]},{"id":"S9020","name":"LODEINFO","url":"https://attack.mitre.org/software/S9020","kind":"malware","description":"[LODEINFO](https://attack.mitre.org/software/S9020) has used control flow flattening to obfuscate code.(Citation: ITOCHU LODEINFO JAN 2024)","relationship_id":"relationship--ddac1aee-5aca-4ccb-bba4-52a2b52e2abc","references":[{"source_name":"ITOCHU LODEINFO JAN 2024","description":"ITOCHU. (2024, January 24). The Endless Struggle Against APT10: Insights from LODEINFO v0.6.6 - v0.7.3 Analysis. Retrieved April 17, 2026.","url":"https://blog-en.itochuci.co.jp/entry/2024/01/24/134100"}]},{"id":"S9025","name":"NOOPLDR","url":"https://attack.mitre.org/software/S9025","kind":"malware","description":"[NOOPLDR](https://attack.mitre.org/software/S9025) can use control flow flattening to help hide malicious code.(Citation: Trend Micro Earth Kasha NOV 2024)(Citation: JPCERT MirrorFace JUL 2024)","relationship_id":"relationship--9e35b5e0-dfac-4c0d-a257-415e091a7344","references":[{"source_name":"JPCERT MirrorFace JUL 2024","description":"Tomonaga, S. (2024, July 16). MirrorFace Attack against Japanese Organisations. Retrieved April 17, 2026.","url":"https://blogs.jpcert.or.jp/en/2024/07/mirrorface-attack-against-japanese-organisations.html"},{"source_name":"Trend Micro Earth Kasha NOV 2024","description":"Trend Micro. (2024, November 19). Spot the Difference: Earth Kasha's New LODEINFO Campaign And The Correlation Analysis With The APT10 Umbrella. Retrieved April 17, 2026.","url":"https://www.trendmicro.com/en_us/research/24/k/lodeinfo-campaign-of-earth-kasha.html"}]},{"id":"S9027","name":"ANELLDR","url":"https://attack.mitre.org/software/S9027","kind":"malware","description":"[ANELLDR](https://attack.mitre.org/software/S9027) code implements anti-analysis techniques including control flow flattening and Mixed Boolean Arithmetic (MBA).(Citation: Trend Micro Earth Kasha Anel NOV 2024)","relationship_id":"relationship--c5afcc91-bdd7-489a-a9d5-9840f5ba2259","references":[{"source_name":"Trend Micro Earth Kasha Anel NOV 2024","description":"Hiroaki, H. (2024, November 26). Guess Who’s Back - The Return of ANEL in the Recent Earth Kasha Spear-phishing Campaign in 2024. Retrieved April 17, 2026.","url":"https://www.trendmicro.com/en_us/research/24/k/return-of-anel-in-the-recent-earth-kasha-spearphishing-campaign.html"}]},{"id":"S9033","name":"Fooder","url":"https://attack.mitre.org/software/S9033","kind":"malware","description":"[Fooder](https://attack.mitre.org/software/S9033) has stored its embedded payload in encrypted form within the binary, using a hardcoded key modified at runtime to produce the AES decryption key.(Citation: ESET_MuddyWater_Dec2025)","relationship_id":"relationship--1bf7899f-98c1-4600-a15a-4e77880c21ee","references":[{"source_name":"ESET_MuddyWater_Dec2025","description":"ESET Research. (2025, December 2). MuddyWater: Snakes by the riverbank. Retrieved February 17, 2026.","url":"https://www.welivesecurity.com/en/eset-research/muddywater-snakes-riverbank/"}]},{"id":"S9037","name":"RustyWater","url":"https://attack.mitre.org/software/S9037","kind":"malware","description":"[RustyWater](https://attack.mitre.org/software/S9037) has an obfuscated function (i.e. love_me__()) that dynamically reconstructs the string WScript.Shell using hard-coded ASCII values and the Chr() function.(Citation: CloudSEK_RustyWater_Jan2026)     ","relationship_id":"relationship--9e44c694-2fc7-4ebd-8e18-7562dce4d60e","references":[{"source_name":"CloudSEK_RustyWater_Jan2026","description":"Awasthi, P. (2026, January 8). Reborn in Rust: Muddy Water Evolves Tooling with RustyWater Implant. Retrieved March 19, 2026.","url":"https://www.cloudsek.com/blog/reborn-in-rust-muddywater-evolves-tooling-with-rustywater-implant"}]},{"id":"S9050","name":"Vidar","url":"https://attack.mitre.org/software/S9050","kind":"malware","description":"[Vidar](https://attack.mitre.org/software/S9050) has also used control flow flattening to slow down static analysis.(Citation: Intrinsec_Vidar_April2026) ","relationship_id":"relationship--d4d7bda4-83fa-4cff-8842-f1b058cafe25","references":[{"source_name":"Intrinsec_Vidar_April2026","description":"Intrinsec. (2026, April). \"Chaos is a ladder\": Vidar's recent rise to the top. Retrieved April 27, 2026.","url":"https://www.intrinsec.com/wp-content/uploads/2026/04/TLP_CLEAR-20260424-New_Vidar.pdf"}]},{"id":"S9051","name":"The Gentlemen Ransomware","url":"https://attack.mitre.org/software/S9051","kind":"malware","description":"[The Gentlemen Ransomware](https://attack.mitre.org/software/S9051) has obfuscated its code using Go libraries such as `Garble`.(Citation: MSTI_GentelmenRansomware_May2026) ","relationship_id":"relationship--e97ea9e0-3988-4135-9c7d-d4e2d1900c34","references":[{"source_name":"MSTI_GentelmenRansomware_May2026","description":"Microsoft Threat Intelligence. (2026, May 28). The Gentlemen ransomware: Dissecting a self-propagating Go encryptor . Retrieved September 18, 2026.","url":"https://www.microsoft.com/en-us/security/blog/2026/05/28/the-gentlemen-ransomware-dissecting-a-self-propagating-go-encryptor/"}]},{"id":"S9053","name":"MiniJunk","url":"https://attack.mitre.org/software/S9053","kind":"malware","description":"[MiniJunk](https://attack.mitre.org/software/S9053) has obfuscated code that utilized junk code insertion, control-flow obfuscation, opaque predicates, obfuscated function calls, and encrypted strings to hinder analysis.(Citation: CheckPoint_NimbusManticoreEurope_Sept2025) ","relationship_id":"relationship--d2d1291b-5a6a-4494-9cdd-402745e346e1","references":[{"source_name":"CheckPoint_NimbusManticoreEurope_Sept2025","description":"Check Point. (2025, September 22). Nimbus Manticore Deploys New Malware Targeting Europe. Retrieved September 24, 2026.","url":"https://research.checkpoint.com/2025/nimbus-manticore-deploys-new-malware-targeting-europe/"}]},{"id":"S9062","name":"MiniBrowse","url":"https://attack.mitre.org/software/S9062","kind":"malware","description":"[MiniBrowse](https://attack.mitre.org/software/S9062) has obfuscated code leveraging junk code insertion, control-flow obfuscation, opaque predicates, obfuscated function calls, and encrypted strings to hinder analysis.(Citation: CheckPoint_NimbusManticoreEurope_Sept2025) ","relationship_id":"relationship--8a636bff-c509-4d29-a28c-1be14ed2d92c","references":[{"source_name":"CheckPoint_NimbusManticoreEurope_Sept2025","description":"Check Point. (2025, September 22). Nimbus Manticore Deploys New Malware Targeting Europe. Retrieved September 24, 2026.","url":"https://research.checkpoint.com/2025/nimbus-manticore-deploys-new-malware-targeting-europe/"}]}],"actors":[{"id":"G0004","name":"Ke3chang","url":"https://attack.mitre.org/groups/G0004","kind":"intrusion-set","description":"[Ke3chang](https://attack.mitre.org/groups/G0004) has used Base64-encoded shellcode strings.(Citation: Microsoft NICKEL December 2021)","relationship_id":"relationship--9a823773-6bcc-4923-8f27-4729e771df2b","references":[{"source_name":"Microsoft NICKEL December 2021","description":"MSTIC. (2021, December 6). NICKEL targeting government organizations across Latin America and Europe. Retrieved March 18, 2022.","url":"https://www.microsoft.com/security/blog/2021/12/06/nickel-targeting-government-organizations-across-latin-america-and-europe"}]},{"id":"G0022","name":"APT3","url":"https://attack.mitre.org/groups/G0022","kind":"intrusion-set","description":"[APT3](https://attack.mitre.org/groups/G0022) obfuscates files or information to help evade defensive measures.(Citation: Symantec Buckeye)","relationship_id":"relationship--56c927c5-f64e-4b31-9a14-7ce78fd1c8a1","references":[{"source_name":"Symantec Buckeye","description":"Symantec Security Response. (2016, September 6). Buckeye cyberespionage group shifts gaze from US to Hong Kong. Retrieved September 26, 2016.","url":"https://web.archive.org/web/20160910124439/http://www.symantec.com/connect/blogs/buckeye-cyberespionage-group-shifts-gaze-us-hong-kong"}]},{"id":"G0034","name":"Sandworm Team","url":"https://attack.mitre.org/groups/G0034","kind":"intrusion-set","description":"[Sandworm Team](https://attack.mitre.org/groups/G0034) has used Base64 encoding within malware variants.(Citation: iSight Sandworm Oct 2014)","relationship_id":"relationship--c2e9f949-59a5-4e96-b0dd-0bde1a507909","references":[{"source_name":"iSight Sandworm Oct 2014","description":"Ward, S.. (2014, October 14). iSIGHT discovers zero-day vulnerability CVE-2014-4114 used in Russian cyber-espionage campaign. Retrieved November 17, 2024.","url":"https://web.archive.org/web/20160503234007/https:/www.isightpartners.com/2014/10/cve-2014-4114/"}]},{"id":"G0047","name":"Gamaredon Group","url":"https://attack.mitre.org/groups/G0047","kind":"intrusion-set","description":"[Gamaredon Group](https://attack.mitre.org/groups/G0047) has delivered self-extracting 7z archive files within malicious document attachments.(Citation: ESET Gamaredon June 2020) Additionally, [Gamaredon Group](https://attack.mitre.org/groups/G0047) has used an obfuscated .drv file.(Citation: SymantecCarbonBlack_ShuckwormUSB_Apr2025) ","relationship_id":"relationship--dd84b767-1623-421b-8f31-048924be5f17","references":[{"source_name":"ESET Gamaredon June 2020","description":"Boutin, J. (2020, June 11). Gamaredon group grows its game. Retrieved June 16, 2020.","url":"https://www.welivesecurity.com/2020/06/11/gamaredon-group-grows-its-game/"},{"source_name":"SymantecCarbonBlack_ShuckwormUSB_Apr2025","description":"Threat Hunter Team, Symantec and Carbon Black. (2025, April 10). Shuckworm Targets Foreign Military Mission Based in Ukraine. Retrieved July 23, 2025.","url":"https://www.security.com/threat-intelligence/shuckworm-ukraine-gammasteel"}]},{"id":"G0063","name":"BlackOasis","url":"https://attack.mitre.org/groups/G0063","kind":"intrusion-set","description":"[BlackOasis](https://attack.mitre.org/groups/G0063)'s first stage shellcode contains a NOP sled with alternative instructions that was likely designed to bypass antivirus tools.(Citation: Securelist BlackOasis Oct 2017)","relationship_id":"relationship--4ad9aa86-f489-4f0f-926f-f381221c3705","references":[{"source_name":"Securelist BlackOasis Oct 2017","description":"Kaspersky Lab's Global Research & Analysis Team. (2017, October 16). BlackOasis APT and new targeted attacks leveraging zero-day exploit. Retrieved February 15, 2018.","url":"https://securelist.com/blackoasis-apt-and-new-targeted-attacks-leveraging-zero-day-exploit/82732/"}]},{"id":"G0067","name":"APT37","url":"https://attack.mitre.org/groups/G0067","kind":"intrusion-set","description":"[APT37](https://attack.mitre.org/groups/G0067) obfuscates strings and payloads.(Citation: Talos Group123)(Citation: Securelist ScarCruft May 2019)(Citation: Volexity InkySquid RokRAT August 2021)","relationship_id":"relationship--9d88636c-32f1-4ea4-b7d9-948e48055d37","references":[{"source_name":"Talos Group123","description":"Mercer, W., Rascagneres, P. (2018, January 16). Korea In The Crosshairs. Retrieved May 21, 2018.","url":"https://blog.talosintelligence.com/2018/01/korea-in-crosshairs.html"},{"source_name":"Securelist ScarCruft May 2019","description":"GReAT. (2019, May 13). ScarCruft continues to evolve, introduces Bluetooth harvester. Retrieved June 4, 2019.","url":"https://securelist.com/scarcruft-continues-to-evolve-introduces-bluetooth-harvester/90729/"},{"source_name":"Volexity InkySquid RokRAT August 2021","description":"Cash, D., Grunzweig, J., Adair, S., Lancaster, T. (2021, August 25). North Korean BLUELIGHT Special: InkySquid Deploys RokRAT. Retrieved October 1, 2021.","url":"https://www.volexity.com/blog/2021/08/24/north-korean-bluelight-special-inkysquid-deploys-rokrat/"}]},{"id":"G0084","name":"Gallmaker","url":"https://attack.mitre.org/groups/G0084","kind":"intrusion-set","description":"[Gallmaker](https://attack.mitre.org/groups/G0084) obfuscated shellcode used during execution.(Citation: Symantec Gallmaker Oct 2018)","relationship_id":"relationship--2e165a8a-928e-488e-ad16-afb77a94b460","references":[{"source_name":"Symantec Gallmaker Oct 2018","description":"Symantec Security Response. (2018, October 10). Gallmaker: New Attack Group Eschews Malware to Live off the Land. Retrieved November 27, 2018.","url":"https://www.symantec.com/blogs/threat-intelligence/gallmaker-attack-group"}]},{"id":"G0093","name":"GALLIUM","url":"https://attack.mitre.org/groups/G0093","kind":"intrusion-set","description":"[GALLIUM](https://attack.mitre.org/groups/G0093) used a modified version of [HTRAN](https://attack.mitre.org/software/S0040) in which they obfuscated strings such as debug messages in an apparent attempt to evade detection.(Citation: Cybereason Soft Cell June 2019)","relationship_id":"relationship--2bff8dad-2ef1-485c-8c0b-62a5ba4c384b","references":[{"source_name":"Cybereason Soft Cell June 2019","description":"Cybereason Nocturnus. (2019, June 25). Operation Soft Cell: A Worldwide Campaign Against Telecommunications Providers. Retrieved July 18, 2019.","url":"https://www.cybereason.com/blog/operation-soft-cell-a-worldwide-campaign-against-telecommunications-providers"}]},{"id":"G0094","name":"Kimsuky","url":"https://attack.mitre.org/groups/G0094","kind":"intrusion-set","description":"[Kimsuky](https://attack.mitre.org/groups/G0094) has obfuscated binary strings including the use of XOR encryption and Base64 encoding.(Citation: ThreatConnect Kimsuky September 2020)(Citation: VirusBulletin Kimsuky October 2019) [Kimsuky](https://attack.mitre.org/groups/G0094) has also modified the first byte of DLL implants targeting victims to prevent recognition of the executable file format.(Citation: Talos Kimsuky Nov 2021) [Kimsuky](https://attack.mitre.org/groups/G0094) has obfuscated strings using Single Instruction Multiple Data (SIMD) instructions that complicate static analysis.(Citation: Gen Digital Kimsuky HTTPTroy October 2025) ","relationship_id":"relationship--a17d1fee-c44e-4e38-85be-68e7dff9d69c","references":[{"source_name":"Gen Digital Kimsuky HTTPTroy October 2025","description":"Alexndru-Cristian Bardas. (2025, October 30). DPRK’s Playbook: Kimsuky’s HttpTroy and Lazarus’s New BLINDINGCAN Variant. Retrieved April 8, 2026.","url":"https://www.gendigital.com/blog/insights/research/dprk-kimsuky-lazarus-analysis"},{"source_name":"Talos Kimsuky Nov 2021","description":"An, J and Malhotra, A. (2021, November 10). North Korean attackers use malicious blogs to deliver malware to high-profile South Korean targets. Retrieved December 29, 2021.","url":"https://blog.talosintelligence.com/2021/11/kimsuky-abuses-blogs-delivers-malware.html"},{"source_name":"VirusBulletin Kimsuky October 2019","description":"Kim, J. et al. (2019, October). KIMSUKY GROUP: TRACKING THE KING OF THE SPEAR PHISHING. Retrieved November 2, 2020.","url":"https://www.virusbulletin.com/virusbulletin/2020/03/vb2019-paper-kimsuky-group-tracking-king-spearphishing/"},{"source_name":"ThreatConnect Kimsuky September 2020","description":"ThreatConnect. (2020, September 28). Kimsuky Phishing Operations Putting In Work. Retrieved October 30, 2020.","url":"https://threatconnect.com/blog/kimsuky-phishing-operations-putting-in-work/"}]},{"id":"G0096","name":"APT41","url":"https://attack.mitre.org/groups/G0096","kind":"intrusion-set","description":"[APT41](https://attack.mitre.org/groups/G0096) used VMProtected binaries in multiple intrusions.(Citation: FireEye APT41 March 2020)","relationship_id":"relationship--f1a9d2b9-f5ec-4119-b3b5-8b46085c01b5","references":[{"source_name":"FireEye APT41 March 2020","description":"Glyer, C, et al. (2020, March). This Is Not a Test: APT41 Initiates Global Intrusion Campaign Using Multiple Exploits. Retrieved April 28, 2020.","url":"https://www.fireeye.com/blog/threat-research/2020/03/apt41-initiates-global-intrusion-campaign-using-multiple-exploits.html"}]},{"id":"G0099","name":"APT-C-36","url":"https://attack.mitre.org/groups/G0099","kind":"intrusion-set","description":"[APT-C-36](https://attack.mitre.org/groups/G0099) has used ConfuserEx to obfuscate its variant of [Imminent Monitor](https://attack.mitre.org/software/S0434), compressed payloads and RAT packages, and password protected encrypted email attachments to avoid detection.(Citation: QiAnXin APT-C-36 Feb2019) [APT-C-36](https://attack.mitre.org/groups/G0099) has also compressed initial droppers into ZIP, LHA and UUE formats.(Citation: Kaspersky BlindEagle AUG 2024)","relationship_id":"relationship--7b4b8d0b-fbc3-469a-ab62-72c5c4c4653d","references":[{"source_name":"Kaspersky BlindEagle AUG 2024","description":"Global Research & Analysis Team, Kaspersky. (2024, August 19). BlindEagle flying high in Latin America. Retrieved April 16, 2026.","url":"https://securelist.com/blindeagle-apt/113414/"},{"source_name":"QiAnXin APT-C-36 Feb2019","description":"QiAnXin Threat Intelligence Center. (2019, February 18). APT-C-36: Continuous Attacks Targeting Colombian Government Institutions and Corporations. Retrieved May 5, 2020.","url":"https://web.archive.org/web/20190625182633if_/https://ti.360.net/blog/articles/apt-c-36-continuous-attacks-targeting-colombian-government-institutions-and-corporations-en/"}]},{"id":"G0106","name":"Rocke","url":"https://attack.mitre.org/groups/G0106","kind":"intrusion-set","description":"[Rocke](https://attack.mitre.org/groups/G0106) has modified UPX headers after packing files to break unpackers.(Citation: Anomali Rocke March 2019)","relationship_id":"relationship--277971c7-d42e-497f-8df4-be5b4bc094f8","references":[{"source_name":"Anomali Rocke March 2019","description":"Anomali Labs. (2019, March 15). Rocke Evolves Its Arsenal With a New Malware Family Written in Golang. Retrieved April 24, 2019.","url":"https://www.anomali.com/blog/rocke-evolves-its-arsenal-with-a-new-malware-family-written-in-golang"}]},{"id":"G0112","name":"Windshift","url":"https://attack.mitre.org/groups/G0112","kind":"intrusion-set","description":"[Windshift](https://attack.mitre.org/groups/G0112) has used string encoding with floating point calculations.(Citation: BlackBerry Bahamut)","relationship_id":"relationship--996defcb-8a62-4271-9d01-93d66525b159","references":[{"source_name":"BlackBerry Bahamut","description":"The BlackBerry Research & Intelligence Team. (2020, October). BAHAMUT: Hack-for-Hire Masters of Phishing, Fake News, and Fake Apps. Retrieved February 8, 2021.","url":"https://www.blackberry.com/us/en/pdfviewer?file=/content/dam/blackberry-com/asset/enterprise/pdf/direct/report-spark-bahamut.pdf"}]},{"id":"G0129","name":"Mustang Panda","url":"https://attack.mitre.org/groups/G0129","kind":"intrusion-set","description":"[Mustang Panda](https://attack.mitre.org/groups/G0129) has delivered initial payloads hidden using archives and encoding measures.(Citation: Anomali MUSTANG PANDA October 2019)(Citation: Cisco Talos MUSTANG PANDA PLUGX PUBLOAD MAY 2022)(Citation: Secureworks BRONZE PRESIDENT December 2019)(Citation: Recorded Future REDDELTA July 2020)(Citation: Crowdstrike MUSTANG PANDA June 2018)(Citation: 2022 November_TrendMicro_Earth Preta_Toneshell_Pubload)(Citation: Proofpoint TA416 November 2020)(Citation: Proofpoint TA416 Europe March 2022)(Citation: Unit42 Bookworm Nov2015) (Citation: Sophos PlugX September 2022)(Citation: Zscaler PAKLOG CorkLog SplatCloak Splatdropper April 2025)(Citation: Zscaler) [Mustang Panda](https://attack.mitre.org/groups/G0129) has also utilized opaque predicates in payloads to hinder analysis.(Citation: Eset PlugX Korplug Mustang Panda March 2022)","relationship_id":"relationship--bf78e7f6-2dc5-4b1b-95bb-03e8e5e0e5a1","references":[{"source_name":"Eset PlugX Korplug Mustang Panda March 2022","description":"Alexandre Cote Cyr. (2022, March 23). Mustang Panda’s Hodur: Old tricks, new Korplug variant. Retrieved September 9, 2025.","url":"https://www.welivesecurity.com/2022/03/23/mustang-panda-hodur-old-tricks-new-korplug-variant/"},{"source_name":"Anomali MUSTANG PANDA October 2019","description":"Anomali Threat Research. (2019, October 7). China-Based APT Mustang Panda Targets Minority Groups, Public and Private Sector Organizations. Retrieved April 12, 2021.","url":"https://www.anomali.com/blog/china-based-apt-mustang-panda-targets-minority-groups-public-and-private-sector-organizations"},{"source_name":"Cisco Talos MUSTANG PANDA PLUGX PUBLOAD MAY 2022","description":"Asheer Malhotra, Jungsoo An, Kendall Mc. (2022, May 5). Mustang Panda deploys a new wave of malware targeting Europe. Retrieved August 4, 2025.","url":"https://blog.talosintelligence.com/mustang-panda-targets-europe/"},{"source_name":"Secureworks BRONZE PRESIDENT December 2019","description":"Counter Threat Unit Research Team. (2019, December 29). BRONZE PRESIDENT Targets NGOs. Retrieved April 13, 2021.","url":"https://www.secureworks.com/research/bronze-president-targets-ngos"},{"source_name":"Recorded Future REDDELTA July 2020","description":"Insikt Group. (2020, July 28). CHINESE STATE-SPONSORED GROUP ‘REDDELTA’ TARGETS THE VATICAN AND CATHOLIC ORGANIZATIONS. Retrieved April 13, 2021.","url":"https://go.recordedfuture.com/hubfs/reports/cta-2020-0728.pdf"},{"source_name":"Crowdstrike MUSTANG PANDA June 2018","description":"Meyers, A. (2018, June 15). Meet CrowdStrike’s Adversary of the Month for June: MUSTANG PANDA. Retrieved April 12, 2021.","url":"https://www.crowdstrike.com/blog/meet-crowdstrikes-adversary-of-the-month-for-june-mustang-panda/"},{"source_name":"2022 November_TrendMicro_Earth Preta_Toneshell_Pubload","description":"Nick Dai, Vickie Su, Sunny Lu. (2022, November 18). Earth Preta Spear-Phishing Governments Worldwide. Retrieved August 4, 2025.","url":"https://www.trendmicro.com/en_us/research/22/k/earth-preta-spear-phishing-governments-worldwide.html"},{"source_name":"Proofpoint TA416 November 2020","description":"Proofpoint Threat Research Team. (2020, November 23). TA416 Goes to Ground and Returns with a Golang PlugX Malware Loader. Retrieved April 13, 2021.","url":"https://www.proofpoint.com/us/blog/threat-insight/ta416-goes-ground-and-returns-golang-plugx-malware-loader"},{"source_name":"Proofpoint TA416 Europe March 2022","description":"Raggi, M. et al. (2022, March 7). The Good, the Bad, and the Web Bug: TA416 Increases Operational Tempo Against European Governments as Conflict in Ukraine Escalates. Retrieved March 16, 2022.","url":"https://www.proofpoint.com/us/blog/threat-insight/good-bad-and-web-bug-ta416-increases-operational-tempo-against-european"},{"source_name":"Unit42 Bookworm Nov2015","description":"Robert Falcone, Mike Scott, Juan Cortes. (2015, November 10). Bookworm Trojan: A Model of Modular Architecture. Retrieved July 21, 2025.","url":"https://unit42.paloaltonetworks.com/bookworm-trojan-a-model-of-modular-architecture/"},{"source_name":"Sophos PlugX September 2022","description":"Secureworks Counter Threat Unit Research Team. (2022, April 27). BRONZE PRESIDENT Targets Russian Speakers with Updated PlugX. Retrieved September 9, 2025.","url":"https://www.secureworks.com/blog/bronze-president-targets-russian-speakers-with-updated-plugx"},{"source_name":"Zscaler PAKLOG CorkLog SplatCloak Splatdropper April 2025","description":"Sudeep Singh. (2025, April 16). Latest Mustang Panda Arsenal: PAKLOG, CorKLOG, and SplatCloak | P2. Retrieved September 12, 2025.","url":"https://www.zscaler.com/blogs/security-research/latest-mustang-panda-arsenal-paklog-corklog-and-splatcloak-p2"},{"source_name":"Zscaler","description":"Sudeep Singh. (2025, April 16). Latest Mustang Panda Arsenal: ToneShell and StarProxy | P1. Retrieved July 21, 2025.","url":"https://www.zscaler.com/blogs/security-research/latest-mustang-panda-arsenal-toneshell-and-starproxy-p1"}]},{"id":"G0135","name":"BackdoorDiplomacy","url":"https://attack.mitre.org/groups/G0135","kind":"intrusion-set","description":"[BackdoorDiplomacy](https://attack.mitre.org/groups/G0135) has obfuscated tools and malware it uses with VMProtect.(Citation: ESET BackdoorDiplomacy Jun 2021)","relationship_id":"relationship--034b1ca2-8202-4eb9-9fbe-b519ed3dd5a8","references":[{"source_name":"ESET BackdoorDiplomacy Jun 2021","description":"Adam Burgher. (2021, June 10). BackdoorDiplomacy: Upgrading from Quarian to Turian. Retrieved September 1, 2021","url":"https://www.welivesecurity.com/2021/06/10/backdoordiplomacy-upgrading-quarian-turian/"}]},{"id":"G1006","name":"Earth Lusca","url":"https://attack.mitre.org/groups/G1006","kind":"intrusion-set","description":"[Earth Lusca](https://attack.mitre.org/groups/G1006) used Base64 to encode strings.(Citation: TrendMicro EarthLusca 2022)","relationship_id":"relationship--c74dfd33-e17a-4fc7-b2bd-154499fc3ac2","references":[{"source_name":"TrendMicro EarthLusca 2022","description":"Chen, J., et al. (2022). Delving Deep: An Analysis of Earth Lusca’s Operations. Retrieved July 1, 2022.","url":"https://www.trendmicro.com/content/dam/trendmicro/global/en/research/22/a/earth-lusca-employs-sophisticated-infrastructure-varied-tools-and-techniques/technical-brief-delving-deep-an-analysis-of-earth-lusca-operations.pdf"}]},{"id":"G1036","name":"Moonstone Sleet","url":"https://attack.mitre.org/groups/G1036","kind":"intrusion-set","description":"[Moonstone Sleet](https://attack.mitre.org/groups/G1036) delivers encrypted payloads in pieces that are then combined together to form a new portable executable (PE) file during installation.(Citation: Microsoft Moonstone Sleet 2024)","relationship_id":"relationship--a6ea2a1c-dfe9-4599-812a-d1f846fb775b","references":[{"source_name":"Microsoft Moonstone Sleet 2024","description":"Microsoft Threat Intelligence. (2024, May 28). Moonstone Sleet emerges as new North Korean threat actor with new bag of tricks. Retrieved August 26, 2024.","url":"https://www.microsoft.com/en-us/security/blog/2024/05/28/moonstone-sleet-emerges-as-new-north-korean-threat-actor-with-new-bag-of-tricks/"}]},{"id":"G1039","name":"RedCurl","url":"https://attack.mitre.org/groups/G1039","kind":"intrusion-set","description":"[RedCurl](https://attack.mitre.org/groups/G1039) has used malware with string encryption.(Citation: therecord_redcurl) [RedCurl](https://attack.mitre.org/groups/G1039) has also encrypted data and has encoded PowerShell commands using Base64.(Citation: group-ib_redcurl1)(Citation: group-ib_redcurl2) [RedCurl](https://attack.mitre.org/groups/G1039) has used `PyArmor` to obfuscate code execution of [LaZagne](https://attack.mitre.org/software/S0349). (Citation: group-ib_redcurl1) Additionally, [RedCurl](https://attack.mitre.org/groups/G1039) has obfuscated downloaded files by renaming them as commonly used tools and has used `echo`, instead of file names themselves, to execute files.(Citation: trendmicro_redcurl) \n","relationship_id":"relationship--06fbdb2f-97d5-4140-9300-0a1f6ab72cb2","references":[{"source_name":"therecord_redcurl","description":"Antoniuk, D. (2023, July 17). RedCurl hackers return to spy on 'major Russian bank,' Australian company. Retrieved August 9, 2024.","url":"https://therecord.media/redcurl-hackers-russian-bank-australian-company"},{"source_name":"group-ib_redcurl1","description":"Group-IB. (2020, August). RedCurl: The Pentest You Didn’t Know About. Retrieved August 9, 2024.","url":"https://www.group-ib.com/resources/research-hub/red-curl/"},{"source_name":"group-ib_redcurl2","description":"Group-IB. (2021, November). RedCurl: The Awakening. Retrieved August 14, 2024.","url":"https://www.group-ib.com/resources/research-hub/red-curl-2/"},{"source_name":"trendmicro_redcurl","description":"Tancio et al. (2024, March 6). Unveiling Earth Kapre aka RedCurl’s Cyberespionage Tactics With Trend Micro MDR, Threat Intelligence. Retrieved August 9, 2024.","url":"https://www.trendmicro.com/en_us/research/24/c/unveiling-earth-kapre-aka-redcurls-cyberespionage-tactics-with-t.html"}]},{"id":"G1059","name":"NIMBUS MANTICORE","url":"https://attack.mitre.org/groups/G1059","kind":"intrusion-set","description":"[NIMBUS MANTICORE](https://attack.mitre.org/groups/G1059) has utilized a mix of obfuscation techniques to hamper analysis of custom malware.(Citation: CheckPoint_NimbusManticoreEurope_Sept2025)   ","relationship_id":"relationship--fdd667be-ef2f-4def-ab36-1a64f960fb1d","references":[{"source_name":"CheckPoint_NimbusManticoreEurope_Sept2025","description":"Check Point. (2025, September 22). Nimbus Manticore Deploys New Malware Targeting Europe. Retrieved September 24, 2026.","url":"https://research.checkpoint.com/2025/nimbus-manticore-deploys-new-malware-targeting-europe/"}]}],"mitigations":[{"id":"M1017","name":"User Training","url":"https://attack.mitre.org/mitigations/M1017","kind":"course-of-action","description":"Ensure that a finite amount of ingress points to a software deployment system exist with restricted access for those required to allow and enable newly deployed software.","relationship_id":"relationship--f4d1e337-60ba-4e28-89d1-ff206bae1750","references":[]},{"id":"M1040","name":"Behavior Prevention on Endpoint","url":"https://attack.mitre.org/mitigations/M1040","kind":"course-of-action","description":"On Windows 10+, enable Attack Surface Reduction (ASR) rules to prevent execution of potentially obfuscated payloads. (Citation: win10_asr)","relationship_id":"relationship--cca451aa-d4ca-4697-ac64-745841fb8658","references":[{"source_name":"win10_asr","description":"Microsoft. (2021, July 2). Use attack surface reduction rules to prevent malware infection. Retrieved June 24, 2021.","url":"https://docs.microsoft.com/microsoft-365/security/defender-endpoint/attack-surface-reduction"}]},{"id":"M1047","name":"Audit","url":"https://attack.mitre.org/mitigations/M1047","kind":"course-of-action","description":"Consider periodic review of common fileless storage locations (such as the Registry or WMI repository) to potentially identify abnormal and malicious data.","relationship_id":"relationship--9f42ded2-e291-4856-91ab-cf5ff8be461a","references":[]},{"id":"M1049","name":"Antivirus/Antimalware","url":"https://attack.mitre.org/mitigations/M1049","kind":"course-of-action","description":"Anti-virus can be used to automatically detect and quarantine suspicious files. Consider utilizing the Antimalware Scan Interface (AMSI) on Windows 10+ to analyze commands after being processed/interpreted. (Citation: Microsoft AMSI June 2015)","relationship_id":"relationship--ffa8f46b-615f-4b95-8ed5-90f86eaedd20","references":[{"source_name":"Microsoft AMSI June 2015","description":"Microsoft. (2015, June 9). Windows 10 to offer application developers new malware defenses. Retrieved February 12, 2018.","url":"https://cloudblogs.microsoft.com/microsoftsecure/2015/06/09/windows-10-to-offer-application-developers-new-malware-defenses/?source=mmpc"}]}],"candidates":[{"id":"129edb75-d7b8-42cd-a8ba-1f3db64ec4ad","name":"DLP Evasion via Sensitive Data in VBA Macro over email","platforms":["windows"],"method":"automated","executor":"powershell","elevation_required":false,"dependency_count":0,"cleanup_defined":false,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1027/T1027.yaml","description":"Upon successful execution, an excel containing VBA Macro containing sensitive data will be sent outside the network using email.\nSensitive data includes about around 20 odd simulated credit card numbers that passes the LUHN check.\n","inputs":{"input_file":{"description":"Path of the XLSM file","type":"path","default":"PathToAtomicsFolder\\T1027\\src\\T1027-cc-macro.xlsm"},"sender":{"description":"sender email","type":"string","default":"test@corp.com"},"receiver":{"description":"receiver email","type":"string","default":"test@corp.com"},"smtp_server":{"description":"SMTP Server IP Address","type":"string","default":"127.0.0.1"}},"dependencies":[],"source_definition_sha256":"e62f7cd6a46a73a2e6dd2bef9cdceec3cf06184db9ef7b2400dc9f6e39159b10"},{"id":"450e7218-7915-4be4-8b9b-464a49eafcec","name":"Execute base64-encoded PowerShell from Windows Registry","platforms":["windows"],"method":"automated","executor":"powershell","elevation_required":false,"dependency_count":0,"cleanup_defined":true,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1027/T1027.yaml","description":"Stores base64-encoded PowerShell code in the Windows Registry and deobfuscates it for execution. This is used by numerous adversaries and malicious tools.\n\nUpon successful execution, powershell will execute encoded command and read/write from the registry.\n","inputs":{"registry_key_storage":{"description":"Windows Registry Key to store code","type":"string","default":"HKCU:Software\\Microsoft\\Windows\\CurrentVersion"},"powershell_command":{"description":"PowerShell command to encode","type":"string","default":"Write-Host \"Hey, Atomic!\""},"registry_entry_storage":{"description":"Windows Registry entry to store code under key","type":"string","default":"Debug"}},"dependencies":[],"source_definition_sha256":"1e2a2c489daf7e6b4533d146c784b08452ed58485ba26f4979599d7381fbec96"},{"id":"6683baf0-6e77-4f58-b114-814184ea8150","name":"Obfuscated PowerShell Command via Character Array","platforms":["windows"],"method":"automated","executor":"powershell","elevation_required":false,"dependency_count":0,"cleanup_defined":true,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1027/T1027.yaml","description":"Spawns a child PowerShell process using character array obfuscation. \nBoth the PowerShell binary name and executed command are constructed \nfrom ASCII values at runtime to evade string-based detection.\n","inputs":{},"dependencies":[],"source_definition_sha256":"3e1938981f95fe4a0147f8353207f3a2f8c67dd186c75a46978e77f3931a3c5f"},{"id":"7e47ee60-9dd1-4269-9c4f-97953b183268","name":"Snake Malware Encrypted crmlog file","platforms":["windows"],"method":"automated","executor":"powershell","elevation_required":true,"dependency_count":0,"cleanup_defined":true,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1027/T1027.yaml","description":"The following Atomic Test will create a file with a specific name and sets its attributes to Hidden, System, and Archive. This was related to the Snake Malware campaign and is later decrypted by Snake's kernel driver.\n[Snake Malware - CISA](https://media.defense.gov/2023/May/09/2003218554/-1/-1/0/JOINT_CSA_HUNTING_RU_INTEL_SNAKE_MALWARE_20230509.PDF)  \n","inputs":{},"dependencies":[],"source_definition_sha256":"e78e804b7a036ff1a9d1dd1b9a1ef7245cfe2fb4c4cdf29d23034fb3e90d40cf"},{"id":"8b3f4ed6-077b-4bdd-891c-2d237f19410f","name":"Obfuscated Command in PowerShell","platforms":["windows"],"method":"automated","executor":"powershell","elevation_required":false,"dependency_count":0,"cleanup_defined":false,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1027/T1027.yaml","description":"This is an obfuscated PowerShell command which when executed prints \"Hello, from PowerShell!\". Example is from the 2021 Threat Detection Report by Red Canary.\n","inputs":{},"dependencies":[],"source_definition_sha256":"bcef2342f59efa96e041c4f975428ead48027d20d146b49b584d248e64ddfd73"},{"id":"a50d5a97-2531-499e-a1de-5544c74432c6","name":"Execute base64-encoded PowerShell","platforms":["windows"],"method":"automated","executor":"powershell","elevation_required":false,"dependency_count":0,"cleanup_defined":false,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1027/T1027.yaml","description":"Creates base64-encoded PowerShell code and executes it. This is used by numerous adversaries and malicious tools.\n\nUpon successful execution, powershell will execute an encoded command and stdout default is \"Write-Host \"Hey, Atomic!\"\n","inputs":{"powershell_command":{"description":"PowerShell command to encode","type":"string","default":"Write-Host \"Hey, Atomic!\""}},"dependencies":[],"source_definition_sha256":"4884d61c21acab46fa63e7891db58e680493aefd3a408aaaefb858227effd551"},{"id":"e2d85e66-cb66-4ed7-93b1-833fc56c9319","name":"DLP Evasion via Sensitive Data in VBA Macro over HTTP","platforms":["windows"],"method":"automated","executor":"powershell","elevation_required":false,"dependency_count":0,"cleanup_defined":false,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1027/T1027.yaml","description":"Upon successful execution, an excel containing VBA Macro containing sensitive data will be sent outside the network using HTTP.\nSensitive data includes about around 20 odd simulated credit card numbers that passes the LUHN check.\n","inputs":{"input_file":{"description":"Path of the XLSM file","type":"path","default":"PathToAtomicsFolder\\T1027\\src\\T1027-cc-macro.xlsm"},"ip_address":{"description":"Destination IP address","type":"string","default":"127.0.0.1"}},"dependencies":[],"source_definition_sha256":"ca0d9e1a7cc3b6b2bed9672125a2b65d62bab486ab442fd51df5c8592db51982"},{"id":"e68b945c-52d0-4dd9-a5e8-d173d70c448f","name":"Obfuscated Command Line using special Unicode characters","platforms":["windows"],"method":"manual","executor":"manual","elevation_required":false,"dependency_count":0,"cleanup_defined":false,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1027/T1027.yaml","description":"This is an obfuscated certutil command that when executed downloads a file from the web. Adapted from T1105. Obfuscation includes special options chars (unicode hyphens), character substitution (e.g. ᶠ) and character insertion (including the usage of the right-to-left 0x202E and left-to-right 0x202D override characters).\nReference:\nhttps://wietze.github.io/blog/windows-command-line-obfuscation\n","inputs":{"remote_file":{"description":"URL of file to download","type":"url","default":"https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/LICENSE.txt"},"local_path":{"description":"Local path/filename to save the downloaded file to","type":"path","default":"Atomic-license.txt"}},"dependencies":[],"source_definition_sha256":"d50c1703b5cf1d3940c901b6e25579b2786117b63b7aec4735ce6a9319baa03d"},{"id":"f45df6be-2e1e-4136-a384-8f18ab3826fb","name":"Decode base64 Data into Script","platforms":["macos","linux"],"method":"automated","executor":"sh","elevation_required":false,"dependency_count":1,"cleanup_defined":true,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1027/T1027.yaml","description":"Creates a base64-encoded data file and decodes it into an executable shell script\n\nUpon successful execution, sh will execute art.sh, which is a base64 encoded command, that echoes `Hello from the Atomic Red Team` \nand uname -v\n","inputs":{"shell_command":{"description":"command to encode","type":"string","default":"echo Hello from the Atomic Red Team && uname -v"}},"dependencies":[{"description":"encode the command into base64 file\n"}],"source_definition_sha256":"47b685b94f6b7f2ae7f38841006a282937b2afb4858af66642bfde7344c4848d"},{"id":"f8c8a909-5f29-49ac-9244-413936ce6d1f","name":"Execution from Compressed File","platforms":["windows"],"method":"automated","executor":"command_prompt","elevation_required":false,"dependency_count":1,"cleanup_defined":true,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1027/T1027.yaml","description":"Mimic execution of compressed executable. When successfully executed, calculator.exe will open.\n","inputs":{"url_path":{"description":"url to download Exe","type":"url","default":"https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1027/bin/T1027.zip"}},"dependencies":[{"description":"T1027.exe must exist on disk at PathToAtomicsFolder\\..\\ExternalPayloads\\temp_T1027.zip\\T1027.exe\n"}],"source_definition_sha256":"109f30977554ac9d1be10270e0ed42f1ac9526a5033a6db7062779e57c7eb813"},{"id":"fad04df1-5229-4185-b016-fb6010cd87ac","name":"Execution from Compressed JScript File","platforms":["windows"],"method":"automated","executor":"command_prompt","elevation_required":false,"dependency_count":1,"cleanup_defined":true,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1027/T1027.yaml","description":"Mimic execution of compressed JavaScript file. When successfully executed, calculator.exe will open. This test is meant to help emulate Gootloader as per https://redcanary.com/blog/gootloader/\n","inputs":{"url_path":{"description":"url to download JScript file","type":"url","default":"https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1027/bin/t1027js.zip"}},"dependencies":[{"description":"T1027.js must exist on disk at PathToAtomicsFolder\\..\\ExternalPayloads\\temp_T1027js.zip\\T1027js.js\n"}],"source_definition_sha256":"f94923d9f29c169c75f85edce6a41ae423965e6f87afb61dc5d5d98836937398"}],"simulation":{"atomic_status":"documented_candidate","lab_execution":"not_run","browser_attack_runner":false,"prerequisites":"Use disposable lab hosts and test accounts, explicit target allowlists, a clean snapshot, bounded egress and a restore plan. Review every candidate and dependency before any execution.","scenario":null},"validation":{"source_identity":"checked_against_pinned_source","relationship_join":"exact_ids_no_inheritance","page_contract":"automated_checks_required","sensor_capture":"not_run","detection_backend":"not_run","adversary_simulation":"not_run","independent_incident_fact_check":"not_performed"},"technique_links":{"T1140":"/ttp-simulation/techniques/enterprise/T1140/","T1204":"/ttp-simulation/techniques/enterprise/T1204/","T1027.010":"/ttp-simulation/techniques/enterprise/T1027.010/","T1059":"/ttp-simulation/techniques/enterprise/T1059/","T1027":"/ttp-simulation/techniques/enterprise/T1027/"},"synthetic":{"schema":"1200km.ttp.collection-fixture.v1","synthetic":true,"technique_key":"enterprise/T1027","purpose":"Collection/parser contract exercise, NOT a positive example or detection of this TTP.","events":[{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0064","collector":"illustrative-lab-collector","observation":{"interpreter":"/bin/sh","command_line":"printf LAB_TELEMETRY_CHECK","actor_uid":1000,"session_id":"lab-session-1"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0039","collector":"illustrative-lab-collector","observation":{"process_id":4200,"path":"C:\\Lab\\demo.txt","action":"create","size_bytes":64}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0059","collector":"illustrative-lab-collector","observation":{"path":"/opt/lab/demo.txt","size_bytes":64,"sha256":"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa","owner_uid":1000}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0061","collector":"illustrative-lab-collector","observation":{"path":"C:\\Lab\\demo.txt","attribute":"content_hash","before":"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa","after":"bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0085","collector":"illustrative-lab-collector","observation":{"flow_id":"lab-flow-1","protocol":"http","method":"GET","path":"/lab-check","payload_excerpt":"LAB_TELEMETRY_CHECK"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0021","collector":"illustrative-lab-collector","observation":{"process_id":4200,"api":"CreateFileW","path":"C:\\Lab\\demo.txt","result":"success"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0032","collector":"illustrative-lab-collector","observation":{"process_guid":"lab-process-001","image":"C:\\Windows\\System32\\whoami.exe","parent_image":"C:\\Windows\\System32\\cmd.exe","command_line":"whoami","user":"LAB\\analyst"}}]}}