T1027.010 Command Obfuscation — ATT&CK Technique
Adversaries may obfuscate content during command execution to impede detection. Command-line obfuscation is a method of making strings and patterns within commands and scripts more difficult to signature and analyze. This type of obfuscation can be included within commands executed by delivered payloads (e.g., Phishing and Drive-by Compromise) or interactively via Command and Scripting Interpreter. For example, adversaries may abuse syntax that utilizes various symbols and escape characters (such as spacing, `^`, `+`. `$`, and `%`) to make commands difficult to analyze while maintaining the same intended functionality. Many languages support built-in obfuscation in the form of base64 or URL encoding. Adversaries may also manually implement command obfuscation via string splitting (`“Wor”+“d.Application”`), order and casing of characters (`rev Invoke-Obfuscation and Invoke-DOSfucation have also been used to obfuscate commands.
Detection coverage (13)
- Invocation Of Crypto-Classes From The "Cryptography" PowerShell Namespace medium
- Registry Set With Crypto-Classes From The "Cryptography" PowerShell Namespace medium
- Python One-Liners with Base64 Decoding high
- Python One-Liners with Base64 Decoding - Linux high
- Obfuscated PowerShell MSI Install via WindowsInstaller COM high
- Potential Obfuscated Ordinal Call Via Rundll32 medium
- Suspicious Explorer Process with Whitespace Padding - ClickFix/FileFix high
- Suspicious Usage of For Loop with Recursive Directory Search in CMD medium
- Suspicious Space Characters in TypedPaths Registry Path - FileFix high
- Suspicious Space Characters in RunMRU Registry Path - ClickFix high
- Windows Command Obfuscation with Environment Variable Substrings
- Windows PowerShell Process Implementing Manual Base64 Decoder
- PowerShell Dynamic Module Invocation Via ExportedCommands Array Index high
Malware using this technique
- IronWind
- Sardonic
- Ursnif
- Tsundere Botnet
- Zeus Panda
- Havoc
- CARROTBAT
- SQLRat
- Emotet
- BADHATCH
- Machete
- FruitFly
- BackConfig
- DarkWatchman
- SHARPSTATS
- Netwalker
- QUADAGENT
- LoudMiner
- RedLine Stealer
- RogueRobin
- Empire
- Sibot
- PHASEJAM
- PoetRAT
- PowerPunch
- ComRAT
- IceApple
- KOCTOPUS
- POWERSTATS
- Astaroth
- QakBot
- CookieMiner
- Denis
- XORIndex Loader
- PowerSploit