T1406 Obfuscated Files or Information — Attack Simulation

DC0114 collection page — Compare manifest declarations with runtime granted state using authorized package inspection and own-app permission checks.

Providers and collection configuration

• Android logcat: Permitted logs from a consented test device/emulator; output depends on build, permissions and instrumentation.
• Android dumpsys: Point-in-time service/package state on an authorized development device.
• Instrumented test application: Own-app permission, API and state callbacks; not universal visibility into other apps.

• Use a disposable emulator or owned development device with approved debugging. Record OS/API level, app version and instrumentation privileges.
• Collect only relevant logcat buffers/tags and service snapshots; add explicit own-app instrumentation for events absent from OS logs.
• Forward sanitized logs and compare before/after state. Remove test data and revoke debugging access after the lab session.

Required normalized fields: package, permission, declared, granted.

adb shell dumpsys package test.example.lab

Read-only snapshot on a consented debug device. Replace the example package with your owned test app. Output and access vary by Android build; this is not a permission-request event stream.

Illustrative collection event

Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.

{
  "schema": "1200km.telemetry.example.v1",
  "synthetic": true,
  "timestamp": "2026-09-27T12:00:00Z",
  "telemetry_id": "DC0114",
  "collector": "illustrative-lab-collector",
  "observation": {
    "package": "test.example.lab",
    "permission": "android.permission.CAMERA",
    "declared": true,
    "granted": false
  }
}

Visibility limits: Android tooling does not imply iOS coverage. Standard mobile apps cannot observe all other apps or protected OS internals; MDM status is not full API, filesystem or content telemetry.

DC0039 collection page — Scope Sysmon FileCreate (11) to the lab directory; retain the process and file path. Differentiate creation/overwrite if the sensor can.

Providers and collection configuration

• Microsoft Sysmon: Windows event-based collection; enable the event types needed below.
• Linux Audit: Linux alternative for supported system-call and file events; different semantics and fields.
• Apple Endpoint Security clients: macOS alternative where the subscribed event exists; requires an entitled, approved client, not an iOS collector.

• On a disposable Windows host, review the installed Sysmon schema and current configuration; merge scoped event filters into the existing policy rather than replacing it.
• Forward Microsoft-Windows-Sysmon/Operational to the lab collector. Preserve event ID, timestamp, computer, process identifiers and the original event.
• For Linux or macOS, select the equivalent sensor separately and test its emitted fields; a Windows event ID does not transfer across platforms.

Required normalized fields: process_id, path, action, size_bytes.

Illustrative collection event

Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.

{
  "schema": "1200km.telemetry.example.v1",
  "synthetic": true,
  "timestamp": "2026-09-27T12:00:00Z",
  "telemetry_id": "DC0039",
  "collector": "illustrative-lab-collector",
  "observation": {
    "process_id": 4200,
    "path": "C:\\Lab\\demo.txt",
    "action": "create",
    "size_bytes": 64
  }
}

Visibility limits: Event filtering and sensor versions change coverage. High-volume image-load and process-access collection needs tuning; endpoint events alone do not establish intent.

DC0016 collection page — Scope Sysmon ImageLoad (7) to lab processes/paths; retain module hash, signer and destination process. Inventory alone does not prove a module loaded.

Providers and collection configuration

• Microsoft Sysmon: Windows event-based collection; enable the event types needed below.
• Linux Audit: Linux alternative for supported system-call and file events; different semantics and fields.
• Apple Endpoint Security clients: macOS alternative where the subscribed event exists; requires an entitled, approved client, not an iOS collector.

• On a disposable Windows host, review the installed Sysmon schema and current configuration; merge scoped event filters into the existing policy rather than replacing it.
• Forward Microsoft-Windows-Sysmon/Operational to the lab collector. Preserve event ID, timestamp, computer, process identifiers and the original event.
• For Linux or macOS, select the equivalent sensor separately and test its emitted fields; a Windows event ID does not transfer across platforms.

Required normalized fields: process_id, image_loaded, signed, action.

Illustrative collection event

Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.

{
  "schema": "1200km.telemetry.example.v1",
  "synthetic": true,
  "timestamp": "2026-09-27T12:00:00Z",
  "telemetry_id": "DC0016",
  "collector": "illustrative-lab-collector",
  "observation": {
    "process_id": 4200,
    "image_loaded": "C:\\Lab\\demo.dll",
    "signed": false,
    "action": "load"
  }
}

Visibility limits: Event filtering and sensor versions change coverage. High-volume image-load and process-access collection needs tuning; endpoint events alone do not establish intent.

DC0082 collection page — Enable scoped Sysmon NetworkConnect (3), disabled by default, or a platform-equivalent process-aware network sensor.

Providers and collection configuration

• Microsoft Sysmon: Windows event-based collection; enable the event types needed below.
• Linux Audit: Linux alternative for supported system-call and file events; different semantics and fields.
• Apple Endpoint Security clients: macOS alternative where the subscribed event exists; requires an entitled, approved client, not an iOS collector.

• On a disposable Windows host, review the installed Sysmon schema and current configuration; merge scoped event filters into the existing policy rather than replacing it.
• Forward Microsoft-Windows-Sysmon/Operational to the lab collector. Preserve event ID, timestamp, computer, process identifiers and the original event.
• For Linux or macOS, select the equivalent sensor separately and test its emitted fields; a Windows event ID does not transfer across platforms.

Required normalized fields: process_guid, destination_ip, destination_port, protocol, initiated.

Illustrative collection event

Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.

{
  "schema": "1200km.telemetry.example.v1",
  "synthetic": true,
  "timestamp": "2026-09-27T12:00:00Z",
  "telemetry_id": "DC0082",
  "collector": "illustrative-lab-collector",
  "observation": {
    "process_guid": "lab-process-001",
    "destination_ip": "198.51.100.20",
    "destination_port": 443,
    "protocol": "tcp",
    "initiated": true
  }
}

Visibility limits: Event filtering and sensor versions change coverage. High-volume image-load and process-access collection needs tuning; endpoint events alone do not establish intent.

DC0085 collection page — Scope approved packet capture/protocol content collection to the lab flow; retain capture provenance and truncation indicators.

Providers and collection configuration

• Zeek: Connection and protocol metadata from traffic visible to the sensor.
• Suricata EVE: Configured flow, alert, DNS, HTTP, TLS and protocol records.

• Use an authorized lab TAP/SPAN, virtual mirror or gateway interface. Define which traffic crosses it; avoid assuming visibility into every segment.
• Enable the required Zeek analyzers or Suricata EVE event types. Export logs with sensor identity, clock synchronization and flow correlation identifiers.
• Monitor capture loss, truncation and exporter sampling. Capture payload only with approval and restrictive retention; encryption normally prevents plaintext inspection.

Required normalized fields: flow_id, protocol, method, path, payload_excerpt.

Illustrative collection event

Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.

{
  "schema": "1200km.telemetry.example.v1",
  "synthetic": true,
  "timestamp": "2026-09-27T12:00:00Z",
  "telemetry_id": "DC0085",
  "collector": "illustrative-lab-collector",
  "observation": {
    "flow_id": "lab-flow-1",
    "protocol": "http",
    "method": "GET",
    "path": "/lab-check",
    "payload_excerpt": "LAB_TELEMETRY_CHECK"
  }
}

Visibility limits: Flows are not packet payloads. NAT, asymmetric routes, encryption, missing mirrors and sampling can hide attribution or content. A destination connection alone does not prove malicious intent.

DC0078 collection page — Collect Zeek conn.log, Suricata flow events or exporter equivalents, including observation point and sampling settings.

Providers and collection configuration

• Zeek: Connection and protocol metadata from traffic visible to the sensor.
• Suricata EVE: Configured flow, alert, DNS, HTTP, TLS and protocol records.
• AWS VPC Flow Logs: IP traffic metadata alternative; no packet payload or DNS answer history, and some traffic is not logged.

• Use an authorized lab TAP/SPAN, virtual mirror or gateway interface. Define which traffic crosses it; avoid assuming visibility into every segment.
• Enable the required Zeek analyzers or Suricata EVE event types. Export logs with sensor identity, clock synchronization and flow correlation identifiers.
• Monitor capture loss, truncation and exporter sampling. Capture payload only with approval and restrictive retention; encryption normally prevents plaintext inspection.

Required normalized fields: source_ip, destination_ip, destination_port, protocol, bytes_sent, bytes_received.

Illustrative collection event

Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.

{
  "schema": "1200km.telemetry.example.v1",
  "synthetic": true,
  "timestamp": "2026-09-27T12:00:00Z",
  "telemetry_id": "DC0078",
  "collector": "illustrative-lab-collector",
  "observation": {
    "source_ip": "192.0.2.10",
    "destination_ip": "198.51.100.20",
    "destination_port": 443,
    "protocol": "tcp",
    "bytes_sent": 128,
    "bytes_received": 512
  }
}

Visibility limits: Flows are not packet payloads. NAT, asymmetric routes, encryption, missing mirrors and sampling can hide attribution or content. A destination connection alone does not prove malicious intent.

MITRE detection strategy

No exact-tagged Sigma source rule was imported. This does not establish that the technique is undetectable; the MITRE guidance and collection requirements remain relevant.

• S0286 OBAD — malware.

  OBAD contains encrypted code along with an obfuscated decryption routine to make it difficult to analyze.[TrendMicro-Obad]

  Exact relationship: relationship--b67f04d9-1cbd-49b4-9ec3-a33a41ac42ab
• S0293 BrainTest — malware.

  BrainTest stores a secondary Android app package (APK) in its assets directory in encrypted form, and decrypts the payload at runtime.[Lookout-BrainTest]

  Exact relationship: relationship--78cc0d6d-6347-45a4-a18c-ca76150aa7a9
• S0312 WireLurker — malware.

  WireLurker obfuscates its payload through complex code structure, multiple component versions, file hiding, code obfuscation and customized encryption to thwart anti-reversing.[PaloAlto-WireLurker]

  Exact relationship: relationship--b3bb33bf-9034-4d5c-8ea0-31d3bbd12b6b
• S0318 XLoader for Android — malware.

  XLoader for Android loads an encrypted DEX code payload.[TrendMicro-XLoader]

  Exact relationship: relationship--a5b72279-f99e-4f03-8669-04322b40ee6b
• S0323 Charger — malware.

  Charger encodes strings into binary arrays to make it difficult to inspect them. It also loads code from encrypted resources dynamically and includes meaningless commands that mask the actual commands passing through.[CheckPoint-Charger]

  Exact relationship: relationship--bee6407a-1f05-4f91-b6e7-a8f8b58fa421
• S0399 Pallas — malware.

  Pallas stores domain information and URL paths as hardcoded AES-encrypted, base64-encoded strings.[Lookout Dark Caracal Jan 2018]

  Exact relationship: relationship--32958f57-ad9b-4fe1-abf3-6f92df895014
• S0406 Gustuff — malware.

  Gustuff obfuscated command information using a custom base85-based encoding.[Talos Gustuff Apr 2019]

  Exact relationship: relationship--0b1aae4b-4dcd-41b6-a708-1441e5a24070
• S0407 Monokle — malware.

  Monokle uses XOR to obfuscate its second stage binary.[Lookout-Monokle]

  Exact relationship: relationship--12098dee-27b3-4d0b-a15a-6b5955ba8879
• S0408 FlexiSpy — tool.

  FlexiSpy encrypts its configuration file using AES.[FortiGuard-FlexiSpy]

  Exact relationship: relationship--a28a53e9-7a42-4f81-bced-0efbc3128cbd
• S0411 Rotexy — malware.

  Starting in 2017, the Rotexy DEX file was packed with garbage strings and/or operations.[securelist rotexy 2018]

  Exact relationship: relationship--a8dd6ed7-910d-4bae-a2a8-19f3f32c915c
• S0420 Dvmap — malware.

  Dvmap decrypts executables from archive files stored in the `assets` directory of the installation binary.[SecureList DVMap June 2017]

  Exact relationship: relationship--d886f368-a38b-4cb3-906f-9b284f58b369
• S0421 GolfSpy — malware.

  GolfSpy encodes its configurations using a customized algorithm.[Trend Micro Bouncing Golf 2019]

  Exact relationship: relationship--60db521a-ae2d-4a9a-8c6d-47a5528f1ecb
• S0423 Ginp — malware.

  Ginp obfuscates its payload, code, and strings.[ThreatFabric Ginp]

  Exact relationship: relationship--f88cbb0c-ca34-4a87-82fa-e0e567ee8d57
• S0427 TrickMo — malware.

  TrickMo contains obfuscated function, class, and variable names, and encrypts its shared preferences using Java’s `PBEWithMD5AndDES` algorithm.[SecurityIntelligence TrickMo]

  Exact relationship: relationship--fd5b3d4b-5d56-4d66-8b57-f858bc139901
• S0432 Bread — malware.

  Bread uses various tricks to obfuscate its strings including standard and custom encryption, programmatically building strings at runtime, and splitting unencrypted strings with repeated delimiters to break up keywords. Bread has also abused Java and JavaScript features to obfuscate code. Bread payloads have hidden code in native libraries and encrypted JAR files in the data section of an ELF file. Bread has stored DEX payloads as base64-encoded strings in the Android manifest and internal Java classes.[Check Point-Joker][Google Bread]

  Exact relationship: relationship--29357289-362c-447c-b387-9a38b50d7296
• S0463 INSOMNIA — malware.

  INSOMNIA obfuscates various pieces of information within the application.[Volexity Insomnia]

  Exact relationship: relationship--2e59d381-eac6-41c6-a5e6-f9617c10259e
• S0478 EventBot — malware.

  EventBot dynamically loads its malicious functionality at runtime from an RC4-encrypted TTF file. EventBot also utilizes ProGuard to obfuscate the generated APK file.[Cybereason EventBot]

  Exact relationship: relationship--bed52256-e5d2-4f15-8c4c-27f709e10c6c
• S0480 Cerberus — malware.

  Cerberus uses standard payload and string obfuscation techniques.[Threat Fabric Cerberus]

  Exact relationship: relationship--386b0a9f-9951-4717-8bce-30c8fbe05050
• S0485 Mandrake — malware.

  Mandrake obfuscates its hardcoded C2 URLs.[Bitdefender Mandrake]

  Exact relationship: relationship--8f2ff9c5-249d-4a9a-bdc6-0cef887eaefc
• S0489 WolfRAT — malware.

  WolfRAT’s code is obfuscated.[Talos-WolfRAT]

  Exact relationship: relationship--91de92af-fe1d-469e-8c36-1a9f4b621a27
• S0494 Zen — malware.

  Zen base64 encodes one of the strings it searches for.[Google Security Zen]

  Exact relationship: relationship--97417113-1840-4e00-98d3-bb222e1a1f60
• S0509 FakeSpy — malware.

  FakeSpy stores its malicious code in encrypted asset files that are decrypted at runtime. Newer versions of FakeSpy encrypt the C2 address.[Cybereason FakeSpy]

  Exact relationship: relationship--7696b512-ba2f-4310-86e1-7c528529fc5e
• S0524 AndroidOS/MalLocker.B — malware.

  AndroidOS/MalLocker.B has employed both name mangling and meaningless variable names in source. AndroidOS/MalLocker.B has stored encrypted payload code in the Assets directory, coupled with a custom decryption routine that assembles a .dex file by passing data through Android Intent objects. [Microsoft MalLockerB]

  Exact relationship: relationship--23cac1d7-27ca-4c78-bfa0-2d6023d21798
• S0525 Android/AdDisplay.Ashas — malware.

  Android/AdDisplay.Ashas has hidden the C2 server address using base-64 encoding. [WeLiveSecurity AdDisplayAshas]

  Exact relationship: relationship--a042d55c-b31e-41c1-9cd0-66070ec9a11d
• S0529 CarbonSteal — malware.

  CarbonSteal has used incorrect file extensions and encryption to hide most of its assets, including secondary APKs, configuration files, and JAR or DEX files.[Lookout Uyghur Campaign]

  Exact relationship: relationship--d7aa436a-e66d-4217-be66-4414703dec07
• S0536 GPlayed — malware.

  GPlayed has base64-encoded the exfiltrated data, replacing some of the base64 characters to further obfuscate the data.[Talos GPlayed]

  Exact relationship: relationship--a299e0a6-cada-4629-a6c6-ed73dc4422aa
• S0539 Red Alert 2.0 — malware.

  Red Alert 2.0 has stored data embedded in the strings.xml resource file.[Sophos Red Alert 2.0]

  Exact relationship: relationship--bb006be2-7d2c-4bb3-ab48-7c95e0ab8106
• S0540 Asacub — malware.

  Asacub has stored encrypted strings in the APK file.[Securelist Asacub]

  Exact relationship: relationship--42f8d024-64a7-4bbf-8c05-2b0c7e667396
• S0544 HenBox — malware.

  HenBox has obfuscated components using XOR, ZIP with a single-byte key or ZIP/Zlib compression wrapped with RC4 encryption.[Palo Alto HenBox]

  Exact relationship: relationship--5b37d94a-64a3-432a-b340-1c9a4f553d02
• S0545 TERRACOTTA — malware.

  TERRACOTTA has stored encoded strings.[WhiteOps TERRACOTTA]

  Exact relationship: relationship--07dd3318-2965-4085-be64-a8e956c7b8da
• S0549 SilkBean — malware.

  SilkBean has hidden malicious functionality in a second stage file and has encrypted C2 server information.[Lookout Uyghur Campaign]

  Exact relationship: relationship--24a7379e-a994-411b-b17c-add6c6c6fc07
• S0550 DoubleAgent — malware.

  DoubleAgent has used an AES encrypted file in the assets folder with an unsuspecting name (e.g. ‘GoogleMusic.png’) for holding configuration and C2 information.[Lookout Uyghur Campaign]

  Exact relationship: relationship--ca486783-9413-4f39-8d2f-3adcb3e79127
• S0555 CHEMISTGAMES — malware.

  CHEMISTGAMES has encrypted its DEX payload.[CYBERWARCON CHEMISTGAMES]

  Exact relationship: relationship--694857ba-92e8-462e-8900-a9f6fdcf495d
• S1054 Drinik — malware.

  Drinik has used custom encryption to hide strings, potentially to evade antivirus products.[cyble_drinik_1022]

  Exact relationship: relationship--8e6b9c1e-5e28-4519-95c3-6b4a836661de
• S1055 SharkBot — malware.

  SharkBot can use a Domain Generation Algorithm to decode the C2 server location.[nccgroup_sharkbot_0322]

  Exact relationship: relationship--a6bb6c55-3b33-4cd4-981b-055551edc4c2
• S1056 TianySpy — malware.

  TianySpy has encrypted C2 details, email addresses, and passwords.[trendmicro_tianyspy_0122]

  Exact relationship: relationship--38cb6365-40ba-47c6-a5e4-1a9be665f951
• S1061 AbstractEmu — malware.

  AbstractEmu has encoded files, such as exploit binaries, to potentially use during and after the rooting process.[lookout_abstractemu_1021]

  Exact relationship: relationship--09d08f16-9e4d-4279-9a8c-bdda7afdb37d
• S1067 FluBot — malware.

  FluBot can obfuscated class, string, and method names in newer malware versions.[proofpoint_flubot_0421]

  Exact relationship: relationship--57e441f8-6799-4d1b-8e2a-13d8ac1c8e78
• S1094 BRATA — malware.

  BRATA has employed code obfuscation and encryption of configuration files.[cleafy_brata_0122][mcafee_brata_0421]

  Exact relationship: relationship--5fb59cf9-9af5-4dd5-9878-dda2ba228ae5
• S1095 AhRat — malware.

  AhRat can use an encryption key received from its C2 to encrypt and decrypt configuration files and exfiltrated data.[welivesecurity_ahrat_0523]

  Exact relationship: relationship--597579b4-7e2f-4843-8cd3-f9143eca34f2
• S1185 LightSpy — malware.

  Using an XOR-chain algorithm, LightSpy decrypts an embedded configuration blob containing URLs for jailbreak components and next-stage payloads. It also decrypts modules in memory and on disk using AES-ECB with the hardcoded key `3e2717e8b3873b29`.[Threatfabric LightSpy 2023][MelikovBlackBerry LightSpy 2024][Threatfabric LightSpy 2024][LinkedIn Dmitry LightSpy 2025] Additionally, LightSpy’s plugins have been encrypted during transmission.[LinkedIn Dmitry LightSpy 2025]

  Exact relationship: relationship--3c4ea7a5-251c-4d10-a724-f4a247f44637
• S1195 SpyC23 — malware.

  SpyC23 has used obfuscation techniques to hide its hardcoded C2 address.[welivesecurity_apt-c-23]

  Exact relationship: relationship--76336d14-0dcb-4fc4-8423-9996dca9a9f2
• S1214 Android/SpyAgent — malware.

  Android/SpyAgent has used the Tencent packer to hide its malicious payload.[McAfee MoqHao 2019]

  Exact relationship: relationship--f524f2d9-cdf7-403b-af0f-96c1c60b32a8
• S1231 GodFather — malware.

  GodFather has obfuscated its Android manifest file with irrelevant permissions and manifest strings.[ZimperiumOrtegaPratapagiri_GodFather_Jun2025]

  Exact relationship: relationship--d7bd4131-a95e-4f6a-a9ce-113079f1dbec
• S9004 Crocodilus — malware.

  Crocodilus has used XOR to encode its payload.[ThreatFabric_Crocodilus_June2025]

  Exact relationship: relationship--04d9e597-f25b-40cf-bdb6-d552255acc78
• S9005 DocSwap — malware.

  DocSwap has used an obfuscated APK file and Base64-encoded URLs and files.[EnkiWhiteHat_KimsukyDOCSWAP_Dec2025][S2W_DocSwap_Mar2025]

  Exact relationship: relationship--033e6e76-2274-4c1f-9a88-a3206836867e
• S9040 NGate — malware.

  NGate has decrypted ASCII-hex data from the `assets/___` resource, which resulted in a config file that has the host IP address, port, `sharedToken`, and more.[CERTPL_NGate_Nov2025]

  Exact relationship: relationship--d7c99131-c898-451c-811a-80505205d1f1