T1140 Deobfuscate/Decode Files or Information — Detection Rules

Source-backed rule directory

• Suspicious Inbox Manipulation Rules · test · high · {"product":"azure","service":"riskdetection"}
• Linux Base64 Encoded Pipe to Shell · test · medium · {"product":"linux","category":"process_creation"}
• Linux Base64 Encoded Shebang In CLI · test · medium · {"product":"linux","category":"process_creation"}
• Linux Shell Pipe to Shell · test · medium · {"product":"linux","category":"process_creation"}
• Payload Decoded and Decrypted via Built-in Utilities · test · medium · {"category":"process_creation","product":"macos"}
• Potential Base64 Decoded From Images · test · high · {"product":"macos","category":"process_creation"}
• PowerShell Decompress Commands · test · informational · {"product":"windows","category":"ps_module","definition":"0ad03ef1-f21b-4a79-8ce8-e6900c54b65b"}
• MSHTA Execution with Suspicious File Extensions · test · high · {"category":"process_creation","product":"windows"}
• Ping Hex IP · test · high · {"category":"process_creation","product":"windows"}
• PowerShell Base64 Encoded FromBase64String Cmdlet · test · high · {"category":"process_creation","product":"windows"}
• Base64 Encoded PowerShell Command Detected · test · high · {"category":"process_creation","product":"windows"}
• Suspicious XOR Encoded PowerShell Command · test · medium · {"category":"process_creation","product":"windows"}
• Potential Commandline Obfuscation Using Escape Characters · test · medium · {"category":"process_creation","product":"windows"}
• DNS-over-HTTPS Enabled by Registry · test · medium · {"product":"windows","category":"registry_set"}

Atlas deterministic concepts

No exact concept selected.

Anomaly models

No exact Atlas model in this snapshot.

ATT&CK analytic guidance

DET0275 Detect Adversary Deobfuscation or Decoding of Files and Payloads

AN0767 Analytic 0767

An adversary leverages built-in tools such as certutil.exe, powershell.exe, or copy.exe to decode, reassemble, or extract hidden malicious content from obfuscated containers or encoded formats. The decoding utility often spawns shortly after file staging or download and may be chained with script interpreters or further payload execution.

AN0768 Analytic 0768

The adversary uses native utilities like base64, gzip, tar, or openssl to decode, decompress, or decrypt files that were previously staged or downloaded. These tools may be chained with curl/wget and executed via bash/zsh, often to extract an embedded payload or reverse shell script.

AN0769 Analytic 0769

The adversary invokes built-in scripting or decoding tools like base64, plutil, or AppleScript-based utilities to decode files embedded in staging artifacts. Decoding often occurs post-download or as part of post-exploitation payload deployment via zsh, python, or osascript.