T1027.010 Command Obfuscation — Detection Rules

Source-backed rule directory

• Python One-Liners with Base64 Decoding - Linux · experimental · high · {"category":"process_creation","product":"linux"}
• Obfuscated PowerShell MSI Install via WindowsInstaller COM · experimental · high · {"category":"process_creation","product":"windows"}
• Python One-Liners with Base64 Decoding · experimental · high · {"category":"process_creation","product":"windows"}
• Potential Obfuscated Ordinal Call Via Rundll32 · test · medium · {"category":"process_creation","product":"windows"}
• Suspicious Explorer Process with Whitespace Padding - ClickFix/FileFix · experimental · high · {"category":"process_creation","product":"windows"}
• Suspicious Usage of For Loop with Recursive Directory Search in CMD · experimental · medium · {"category":"process_creation","product":"windows"}
• Suspicious Space Characters in RunMRU Registry Path - ClickFix · experimental · high · {"category":"registry_set","product":"windows"}
• Suspicious Space Characters in TypedPaths Registry Path - FileFix · experimental · high · {"category":"registry_set","product":"windows"}

Atlas deterministic concepts

No exact concept selected.

Anomaly models

No exact Atlas model in this snapshot.

ATT&CK analytic guidance

DET0505 Detection Strategy for Command Obfuscation

AN1394 Analytic 1394

Detection of command-line activity exhibiting syntactic obfuscation patterns, such as excessive escape characters, base64 encoding, command concatenation, or outlier command length and entropy.

AN1395 Analytic 1395

Detection of shell commands that leverage encoded execution, command chaining, excessive piping, or unusual token patterns indicative of obfuscation.

AN1396 Analytic 1396

Detection of obfuscated commands via shell, osascript, or AppleScript interpreters using unusual tokens, encoding, variable substitution, or runtime string reconstruction.