Loading interactive filters…

1200KM / detection

T1027 Obfuscated Files or Information — Detection Rules

Detection workspace for T1027 Obfuscated Files or Information: 87 Sigma sources, 1 Atlas concepts and 1 anomaly models. No live detection validation.

Source-backed rule directory

Suspicious Filename with Embedded Base64 Commands · experimental · high · {"product":"linux","category":"file_event"}
Decode Base64 Encoded Text · test · low · {"category":"process_creation","product":"linux"}
Decode Base64 Encoded Text -MacOs · test · low · {"category":"process_creation","product":"macos"}
Invoke-Obfuscation CLIP+ Launcher - Security · test · high · {"product":"windows","service":"security","definition":"The 'System Security Extension' audit subcategory need to be enabled to log the EID 4697"}
Invoke-Obfuscation Obfuscated IEX Invocation - Security · test · high · {"product":"windows","service":"security","definition":"The 'System Security Extension' audit subcategory need to be enabled to log the EID 4697"}
Invoke-Obfuscation STDIN+ Launcher - Security · test · high · {"product":"windows","service":"security","definition":"The 'System Security Extension' audit subcategory need to be enabled to log the EID 4697"}
Invoke-Obfuscation VAR+ Launcher - Security · test · high · {"product":"windows","service":"security","definition":"The 'System Security Extension' audit subcategory need to be enabled to log the EID 4697"}
Invoke-Obfuscation COMPRESS OBFUSCATION - Security · test · medium · {"product":"windows","service":"security","definition":"The 'System Security Extension' audit subcategory need to be enabled to log the EID 4697"}
Invoke-Obfuscation RUNDLL LAUNCHER - Security · test · medium · {"product":"windows","service":"security","definition":"The 'System Security Extension' audit subcategory need to be enabled to log the EID 4697"}
Invoke-Obfuscation Via Stdin - Security · test · high · {"product":"windows","service":"security","definition":"The 'System Security Extension' audit subcategory need to be enabled to log the EID 4697"}
Invoke-Obfuscation Via Use Clip - Security · test · high · {"product":"windows","service":"security","definition":"The 'System Security Extension' audit subcategory need to be enabled to log the EID 4697"}
Invoke-Obfuscation Via Use MSHTA - Security · test · high · {"product":"windows","service":"security","definition":"The 'System Security Extension' audit subcategory need to be enabled to log the EID 4697"}
Invoke-Obfuscation Via Use Rundll32 - Security · test · high · {"product":"windows","service":"security","definition":"The 'System Security Extension' audit subcategory need to be enabled to log the EID 4697"}
Invoke-Obfuscation VAR++ LAUNCHER OBFUSCATION - Security · test · high · {"product":"windows","service":"security","definition":"The 'System Security Extension' audit subcategory need to be enabled to log the EID 4697"}
Password Protected ZIP File Opened · test · medium · {"product":"windows","service":"security"}
Password Protected ZIP File Opened (Suspicious Filenames) · test · high · {"product":"windows","service":"security"}
Password Protected ZIP File Opened (Email Attachment) · test · high · {"product":"windows","service":"security"}
Invoke-Obfuscation CLIP+ Launcher - System · test · high · {"product":"windows","service":"system"}
Invoke-Obfuscation Obfuscated IEX Invocation - System · test · high · {"product":"windows","service":"system"}
Invoke-Obfuscation STDIN+ Launcher - System · test · high · {"product":"windows","service":"system"}
Invoke-Obfuscation VAR+ Launcher - System · test · high · {"product":"windows","service":"system"}
Invoke-Obfuscation COMPRESS OBFUSCATION - System · test · medium · {"product":"windows","service":"system"}
Invoke-Obfuscation RUNDLL LAUNCHER - System · test · medium · {"product":"windows","service":"system"}
Invoke-Obfuscation Via Stdin - System · test · high · {"product":"windows","service":"system"}
Invoke-Obfuscation Via Use Clip - System · test · high · {"product":"windows","service":"system"}
Invoke-Obfuscation Via Use MSHTA - System · test · high · {"product":"windows","service":"system"}
Invoke-Obfuscation Via Use Rundll32 - System · test · high · {"product":"windows","service":"system"}
Invoke-Obfuscation VAR++ LAUNCHER OBFUSCATION - System · test · high · {"product":"windows","service":"system"}
Potential Winnti Dropper Activity · test · high · {"product":"windows","category":"file_event"}
Suspicious Get-Variable.exe Creation · test · high · {"product":"windows","category":"file_event"}
Invoke-Obfuscation CLIP+ Launcher - PowerShell Module · test · high · {"product":"windows","category":"ps_module","definition":"0ad03ef1-f21b-4a79-8ce8-e6900c54b65b"}
Invoke-Obfuscation Obfuscated IEX Invocation - PowerShell Module · test · high · {"product":"windows","category":"ps_module","definition":"0ad03ef1-f21b-4a79-8ce8-e6900c54b65b"}
Invoke-Obfuscation STDIN+ Launcher - PowerShell Module · test · high · {"product":"windows","category":"ps_module","definition":"0ad03ef1-f21b-4a79-8ce8-e6900c54b65b"}
Invoke-Obfuscation VAR+ Launcher - PowerShell Module · test · high · {"product":"windows","category":"ps_module","definition":"0ad03ef1-f21b-4a79-8ce8-e6900c54b65b"}
Invoke-Obfuscation COMPRESS OBFUSCATION - PowerShell Module · test · medium · {"product":"windows","category":"ps_module","definition":"0ad03ef1-f21b-4a79-8ce8-e6900c54b65b"}
Invoke-Obfuscation RUNDLL LAUNCHER - PowerShell Module · test · medium · {"product":"windows","category":"ps_module","definition":"0ad03ef1-f21b-4a79-8ce8-e6900c54b65b"}
Invoke-Obfuscation Via Stdin - PowerShell Module · test · high · {"product":"windows","category":"ps_module","definition":"0ad03ef1-f21b-4a79-8ce8-e6900c54b65b"}
Invoke-Obfuscation Via Use Clip - PowerShell Module · test · high · {"product":"windows","category":"ps_module","definition":"0ad03ef1-f21b-4a79-8ce8-e6900c54b65b"}
Invoke-Obfuscation Via Use MSHTA - PowerShell Module · test · high · {"product":"windows","category":"ps_module","definition":"0ad03ef1-f21b-4a79-8ce8-e6900c54b65b"}
Invoke-Obfuscation Via Use Rundll32 - PowerShell Module · test · high · {"product":"windows","category":"ps_module","definition":"0ad03ef1-f21b-4a79-8ce8-e6900c54b65b"}
Invoke-Obfuscation VAR++ LAUNCHER OBFUSCATION - PowerShell Module · test · high · {"product":"windows","category":"ps_module","definition":"0ad03ef1-f21b-4a79-8ce8-e6900c54b65b"}
Invoke-Obfuscation CLIP+ Launcher - PowerShell · test · high · {"product":"windows","category":"ps_script","definition":"Requirements: Script Block Logging must be enabled"}
Invoke-Obfuscation Obfuscated IEX Invocation - PowerShell · test · high · {"product":"windows","category":"ps_script","definition":"Requirements: Script Block Logging must be enabled"}
Invoke-Obfuscation STDIN+ Launcher - Powershell · test · high · {"product":"windows","category":"ps_script","definition":"Requirements: Script Block Logging must be enabled"}
Invoke-Obfuscation VAR+ Launcher - PowerShell · test · high · {"product":"windows","category":"ps_script","definition":"Requirements: Script Block Logging must be enabled"}
Invoke-Obfuscation COMPRESS OBFUSCATION - PowerShell · test · medium · {"product":"windows","category":"ps_script","definition":"Requirements: Script Block Logging must be enabled"}
Invoke-Obfuscation RUNDLL LAUNCHER - PowerShell · test · medium · {"product":"windows","category":"ps_script","definition":"Requirements: Script Block Logging must be enabled"}
Invoke-Obfuscation Via Stdin - Powershell · test · high · {"product":"windows","category":"ps_script","definition":"Requirements: Script Block Logging must be enabled"}
Invoke-Obfuscation Via Use Clip - Powershell · test · high · {"product":"windows","category":"ps_script","definition":"Requirements: Script Block Logging must be enabled"}
Invoke-Obfuscation Via Use MSHTA - PowerShell · test · high · {"product":"windows","category":"ps_script","definition":"Requirements: Script Block Logging must be enabled"}
Invoke-Obfuscation Via Use Rundll32 - PowerShell · test · high · {"product":"windows","category":"ps_script","definition":"Requirements: Script Block Logging must be enabled"}
Invoke-Obfuscation VAR++ LAUNCHER OBFUSCATION - PowerShell · test · high · {"product":"windows","category":"ps_script","definition":"Requirements: Script Block Logging must be enabled"}
Potential PowerShell Obfuscation Using Character Join · test · low · {"product":"windows","category":"ps_script","definition":"Requirements: Script Block Logging must be enabled"}
Potential PowerShell Obfuscation Using Alias Cmdlets · test · low · {"product":"windows","category":"ps_script","definition":"Requirements: Script Block Logging must be enabled"}
File Decoded From Base64/Hex Via Certutil.EXE · test · high · {"category":"process_creation","product":"windows"}
Suspicious Download Via Certutil.EXE · test · medium · {"category":"process_creation","product":"windows"}
Suspicious File Downloaded From Direct IP Via Certutil.EXE · test · high · {"category":"process_creation","product":"windows"}
Suspicious File Downloaded From File-Sharing Website Via Certutil.EXE · test · high · {"category":"process_creation","product":"windows"}
File Encoded To Base64 Via Certutil.EXE · test · medium · {"category":"process_creation","product":"windows"}
Suspicious File Encoded To Base64 Via Certutil.EXE · test · high · {"category":"process_creation","product":"windows"}
File In Suspicious Location Encoded To Base64 Via Certutil.EXE · test · high · {"category":"process_creation","product":"windows"}
Certificate Exported Via Certutil.EXE · test · medium · {"category":"process_creation","product":"windows"}
Invoke-Obfuscation CLIP+ Launcher · test · high · {"category":"process_creation","product":"windows"}
Invoke-Obfuscation Obfuscated IEX Invocation · test · high · {"category":"process_creation","product":"windows"}
Invoke-Obfuscation STDIN+ Launcher · test · high · {"category":"process_creation","product":"windows"}
Invoke-Obfuscation VAR+ Launcher · test · high · {"category":"process_creation","product":"windows"}
Invoke-Obfuscation COMPRESS OBFUSCATION · test · medium · {"category":"process_creation","product":"windows"}
Invoke-Obfuscation Via Stdin · test · high · {"category":"process_creation","product":"windows"}
Invoke-Obfuscation Via Use Clip · test · high · {"category":"process_creation","product":"windows"}
Invoke-Obfuscation Via Use MSHTA · test · high · {"category":"process_creation","product":"windows"}
Invoke-Obfuscation VAR++ LAUNCHER OBFUSCATION · test · high · {"category":"process_creation","product":"windows"}
Ping Hex IP · test · high · {"category":"process_creation","product":"windows"}
PowerShell Base64 Encoded Invoke Keyword · test · high · {"category":"process_creation","product":"windows"}
PowerShell Base64 Encoded Reflective Assembly Load · test · high · {"category":"process_creation","product":"windows"}
Suspicious Encoded And Obfuscated Reflection Assembly Load Function Call · test · high · {"category":"process_creation","product":"windows"}
PowerShell Base64 Encoded WMI Classes · test · high · {"category":"process_creation","product":"windows"}
ConvertTo-SecureString Cmdlet Usage Via CommandLine · test · medium · {"category":"process_creation","product":"windows"}
Potential PowerShell Obfuscation Via Reversed Commands · test · high · {"category":"process_creation","product":"windows"}
Potential PowerShell Command Line Obfuscation · test · high · {"category":"process_creation","product":"windows"}
Potential Encoded PowerShell Patterns In CommandLine · test · low · {"category":"process_creation","product":"windows"}
Base64 Encoded PowerShell Command Detected · test · high · {"category":"process_creation","product":"windows"}
Potential PowerShell Obfuscation Via WCHAR/CHAR · test · high · {"category":"process_creation","product":"windows"}
Suspicious XOR Encoded PowerShell Command · test · medium · {"category":"process_creation","product":"windows"}
PUA - Potential PE Metadata Tamper Using Rcedit · test · medium · {"category":"process_creation","product":"windows"}
Renamed AutoIt Execution · test · high · {"category":"process_creation","product":"windows"}
Potential CommandLine Obfuscation Using Unicode Characters From Suspicious Image · test · high · {"category":"process_creation","product":"windows"}
Suspicious SYSTEM User Process Creation · test · high · {"category":"process_creation","product":"windows"}

Atlas deterministic concepts

T1027 Obfuscated Files or Information

MATCH(command_line_contains_encoding_flags OR script_matches_obfuscation_signature OR file_packer_signature) -> ALERT

Anomaly models

Encoded, packed, or obfuscated content — T1027 Obfuscated Files or Information

Comparison unit: content or command representation.

Expected behavior: ordinary content has stable length, entropy, token, and character distributions.

Deviation: extreme entropy, rare token composition, or distribution shift.

ATT&CK analytic guidance

DET0378 Behavioral Detection of Obfuscated Files or Information

AN1064 Analytic 1064

Correlates script execution or suspicious parent processes with creation or modification of encoded, compressed, or encrypted file formats (e.g., .zip, .7z, .enc) and abnormal command-line syntax or PowerShell obfuscation.

AN1065 Analytic 1065

Detects use of gzip, base64, tar, or openssl in scripts or commands that encode/encrypt files after file staging or system enumeration.

AN1066 Analytic 1066

Monitors use of archive or encryption tools (zip, openssl) tied to user-scripted activity or binaries writing encoded payloads under /Users or /Volumes.

AN1067 Analytic 1067

Identifies transfer of base64, uuencoded, or high-entropy files over HTTP, FTP, or custom protocols in lateral movement or exfiltration streams.

AN1068 Analytic 1068

Detects encoded PowerCLI or Base64-encoded payloads staged via datastore uploads or shell access (e.g., ESXi Shell or backdoored VIBs).

Connected ecosystem references

Linked tags

rule_source_available Distribution-Shift Anomaly Entropy Anomaly Tail Anomaly

Simulation, tools and telemetry

T1027 simulation workspace

Threat actor context

These are explicit actor-to-technique associations in the existing Threat Matrix snapshot, not attribution of an event or proof that a detector identifies the actor. No tool-to-actor relationship is inferred.

Existing anomaly research

Original publication snapshot · Anomaly Detection Atlas

Connected anomaly research

Curated research views reached through an exact source technique, a catalog model, or a reviewed collection reference. These are navigation associations, not claims of detector effectiveness or sensor equivalence.

Multi-Event Correlation

Telemetry contracts · Maintained query examples · Validation and blind spots

Pinned research references. No browser attack runner, live simulation result or validated detector is asserted. Source mappings and validation limits are preserved. ATT&CK / Atomic provenance · Detection provenance.