T1027.013 Encrypted/Encoded File — Attack Simulation

Adversaries may encrypt or encode files to obfuscate strings, bytes, and other specific patterns to impede detection. Encrypting and/or encoding file content aims to conceal malicious artifacts within a file used in an intrusion. Many other techniques, such as Software Packing, Steganography, and Embedded Payloads, share this same broad objective. Encrypting and/or encoding files could lead to a lapse in detection of static signatures, only for…

Technique description

At least one platform-compatible Atomic procedure is documented. Individual review, lab prerequisites, and validation remain required.

Official ATT&CK definition · Detection rules and anomaly models

Documented simulation candidates

Turla Snake Queue File Artifact
windows automated powershell
Procedure 6e8dea32-206e-482c-bdfa-f1ca6a737258; elevation required; cleanup present, not reviewed. Not executed or individually validated.
Decode Eicar File and Write to File
windows macos linux automated powershell
Procedure 7693ccaa-8d64-4043-92a5-a2eb70359535; elevation not declared required; cleanup present, not reviewed. Not executed or individually validated.
Decrypt Eicar File and Write to File
windows macos linux automated powershell
Procedure b404caaa-12ce-43c7-9214-62a531c044f7; elevation not declared required; cleanup present, not reviewed. Not executed or individually validated.
Password-Protected ZIP Payload Extraction and Execution
linux macos automated bash
Procedure c2ca068a-eb1e-498f-9f93-3d554c455916; elevation not declared required; cleanup present, not reviewed. Not executed or individually validated.

Connected ecosystem references

Linked tags

enterprise cloud-hosted-endpoint onprem Linux macOS Windows stealth isolated_authorized_lab procedure_review_required telemetry_configuration_required some_candidates_require_elevation

can_simulate subtechnique source_mapped

Detection and collection

T1027.013 detection workspace

Attack tools

Threat actor context

These are explicit actor-to-technique associations in the existing Threat Matrix snapshot, not attribution of an event or proof that a detector identifies the actor. No tool-to-actor relationship is inferred.

Existing research

Threat Matrix: knowledge routes, evidence and actor context

Pinned research references. No browser attack runner, live simulation result or validated detector is asserted. Source mappings and validation limits are preserved. ATT&CK / Atomic provenance · Detection provenance.