{"id":"T1027.010","name":"Command Obfuscation","url":"https://attack.mitre.org/techniques/T1027/010","tactics":["stealth"],"platforms":["Linux","macOS","Windows"],"live":true,"revoked":false,"deprecated":false,"revoked_by":null,"detection_strategies":[{"id":"DET0505","stix_id":"x-mitre-detection-strategy--72d668ba-f4d1-43ff-b7b1-0dbad9ec6ed9","name":"Detection Strategy for Command Obfuscation","url":"https://attack.mitre.org/detectionstrategies/DET0505","analytics":[{"id":"AN1394","stix_id":"x-mitre-analytic--e6e98024-2fa7-444c-af90-32ec5d4d2666","name":"Analytic 1394","description":"Detection of command-line activity exhibiting syntactic obfuscation patterns, such as excessive escape characters, base64 encoding, command concatenation, or outlier command length and entropy.","url":"https://attack.mitre.org/detectionstrategies/DET0505#AN1394","platforms":["Windows"],"log_source_references":[{"name":"WinEventLog:Security","channel":"EventCode=4688","data_component":"DC0032","data_component_name":"Process Creation","log_source_slug":"wineventlog-security"}],"mutable_elements":[{"field":"CommandLineEntropyThreshold","description":"Used to flag base64 or token-heavy command-line strings"},{"field":"SuspiciousCharacterCount","description":"Escape character and symbol frequency in command-line strings"},{"field":"TimeWindow","description":"Window between command execution and follow-up child or file write behavior"}],"live":true,"detection_strategies":["DET0505"],"techniques":["T1027.010"]},{"id":"AN1395","stix_id":"x-mitre-analytic--cad9e775-f40f-42fb-8e86-c7aba249a8e4","name":"Analytic 1395","description":"Detection of shell commands that leverage encoded execution, command chaining, excessive piping, or unusual token patterns indicative of obfuscation.","url":"https://attack.mitre.org/detectionstrategies/DET0505#AN1395","platforms":["Linux"],"log_source_references":[{"name":"auditd:SYSCALL","channel":"execve","data_component":"DC0032","data_component_name":"Process Creation","log_source_slug":"auditd-syscall"},{"name":"linux:osquery","channel":"process_events.command_line","data_component":"DC0064","data_component_name":"Command Execution","log_source_slug":"linux-osquery"}],"mutable_elements":[{"field":"CommandLineTokenCount","description":"Tuning value for token or argument count in shell invocations"},{"field":"EncodedExecRegex","description":"Environment-specific regex patterns for encoded or eval'd command lines"},{"field":"GlobPatternAnomalies","description":"Shell-specific globbing or directory traversal string detection"}],"live":true,"detection_strategies":["DET0505"],"techniques":["T1027.010"]},{"id":"AN1396","stix_id":"x-mitre-analytic--20157d55-1760-483c-a3b1-c6e219eeb75c","name":"Analytic 1396","description":"Detection of obfuscated commands via shell, osascript, or AppleScript interpreters using unusual tokens, encoding, variable substitution, or runtime string reconstruction.","url":"https://attack.mitre.org/detectionstrategies/DET0505#AN1396","platforms":["macOS"],"log_source_references":[{"name":"macos:unifiedlog","channel":"process:spawn, process:exec","data_component":"DC0064","data_component_name":"Command Execution","log_source_slug":"macos-unifiedlog"},{"name":"macos:endpointsecurity","channel":"ES_EVENT_TYPE_NOTIFY_EXEC","data_component":"DC0032","data_component_name":"Process Creation","log_source_slug":"macos-endpointsecurity"}],"mutable_elements":[{"field":"InterpreterParentFilter","description":"Limits detection scope to shell or scripting interpreters like zsh, bash, osascript"},{"field":"ScriptEntropyThreshold","description":"Minimum entropy required to consider the command or script obfuscated"},{"field":"ArgumentLengthDeviation","description":"Deviation from baseline for long or highly nested arguments"}],"live":true,"detection_strategies":["DET0505"],"techniques":["T1027.010"]}],"live":true,"version":"1.0","techniques":["T1027.010"]}],"sigma_rules":[{"id":"1c2a3268-3881-414a-80af-a5b313b14c0e","title":"Registry Set With Crypto-Classes From The \"Cryptography\" PowerShell Namespace","author":"Andreas Braathen (mnemonic.io)","status":"test","level":"medium","date":"2023-12-01","modified":null,"description":"Detects the setting of a registry inside the \"\\Shell\\Open\\Command\" value with PowerShell classes from the \"System.Security.Cryptography\" namespace.\nThe PowerShell namespace \"System.Security.Cryptography\" provides classes for on-the-fly encryption and decryption.\nThese can be used for example in decrypting malicious payload for defense evasion.\n","references":["https://learn.microsoft.com/en-us/dotnet/api/system.security.cryptography?view=net-8.0","https://squiblydoo.blog/2023/11/07/october-2023-solarmarker/"],"logsource":{"product":"windows","category":"registry_set"},"tags":["attack.execution","attack.persistence","attack.privilege-escalation","attack.stealth","attack.t1059.001","attack.t1027.010","attack.t1547.001","detection.threat-hunting"],"path":"rules-threat-hunting/windows/registry/registry_set/registry_set_powershell_crypto_namespace.yml","techniques":["T1059.001","T1027.010","T1547.001"],"cves":[]},{"id":"2782fbd8-b662-4eb5-9962-5bfbfb671e7b","title":"Suspicious Usage of For Loop with Recursive Directory Search in CMD","author":"Joseliyo Sanchez, @Joseliyo_Jstnk","status":"experimental","level":"medium","date":"2025-11-12","modified":null,"description":"Detects suspicious usage of the cmd.exe 'for /f' loop combined with the 'tokens=' parameter and a recursive directory listing.\nThis pattern may indicate an attempt to discover and execute system binaries dynamically, for example powershell, a technique sometimes used by attackers to evade detection.\nThis behavior has been observed in various malicious lnk files.\n","references":["https://www.virustotal.com/gui/file/29837d0d3202758063185828c8f8d9e0b7b42b365c8941cc926d2d7c7bae2fb3"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.execution","attack.stealth","attack.t1059.003","attack.t1027.010"],"path":"rules/windows/process_creation/proc_creation_win_susp_cmd_for_loop_execution_with_recursive_directory_search.yml","techniques":["T1059.003","T1027.010"],"cves":[]},{"id":"3ae9974a-eb09-4044-8e70-8980a50c12c8","title":"Suspicious Explorer Process with Whitespace Padding - ClickFix/FileFix","author":"Swachchhanda Shrawan Poudel (Nextron Systems)","status":"experimental","level":"high","date":"2025-11-04","modified":"2025-11-26","description":"Detects process creation with suspicious whitespace padding followed by a '#' character, which may indicate ClickFix or FileFix techniques used to conceal malicious commands from visual inspection.\nClickFix and FileFix are social engineering attack techniques where adversaries distribute phishing documents or malicious links that deceive users into opening the Windows Run dialog box or File Explorer search bar.\nThe victims are then instructed to paste commands from their clipboard, which contain extensive whitespace padding using various Unicode space characters to push the actual malicious command far to the right, effectively hiding it from immediate view.\n","references":["https://expel.com/blog/cache-smuggling-when-a-picture-isnt-a-thousand-words/","https://mrd0x.com/filefix-clickfix-alternative/"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.execution","attack.stealth","attack.t1204.004","attack.t1027.010"],"path":"rules/windows/process_creation/proc_creation_win_susp_clickfix_filefix_whitespace_padding.yml","techniques":["T1204.004","T1027.010"],"cves":[]},{"id":"43fa5350-db63-4b8f-9a01-789a427074e1","title":"Potential Obfuscated Ordinal Call Via Rundll32","author":"Nasreddine Bencherchali (Nextron Systems), Swachchhanda Shrawan Poudel (Nextron Systems)","status":"test","level":"medium","date":"2023-05-17","modified":"2025-02-23","description":"Detects execution of \"rundll32\" with potential obfuscated ordinal calls","references":["Internal Research","https://www.youtube.com/watch?v=52tAmVLg1KM&t=2070s"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.stealth","attack.t1027.010"],"path":"rules/windows/process_creation/proc_creation_win_rundll32_obfuscated_ordinal_call.yml","techniques":["T1027.010"],"cves":[]},{"id":"50a0aa3d-ab16-4594-a8aa-5145a6e6792b","title":"Python One-Liners with Base64 Decoding","author":"Hugh Ryan (HueCodes), Swachchhanda Shrawan Poudel (Nextron Systems)","status":"experimental","level":"high","date":"2026-03-09","modified":null,"description":"Detects Python one-liners that use base64 decoding functions in command line executions.\nMalicious scripts or attackers often use python one-liners to decode and execute base64-encoded payloads, which is a common technique for obfuscation and evasion.\n","references":["https://docs.python.org/3/library/base64.html","https://www.virustotal.com/gui/file/bc43e925d7b4b74319f6e74e836a96f1997ba404e14ac566cf12a21e9da463db/behavior","https://cloud.google.com/blog/topics/threat-intelligence/cybercriminals-weaponize-fake-ai-websites"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.execution","attack.stealth","attack.t1059.006","attack.t1027.010"],"path":"rules/windows/process_creation/proc_creation_win_python_base64_encoded_execution.yml","techniques":["T1059.006","T1027.010"],"cves":[]},{"id":"55e862a8-dd9c-4651-807a-f21fcad56716","title":"Python One-Liners with Base64 Decoding - Linux","author":"Hugh Ryan (HueCodes), Swachchhanda Shrawan Poudel (Nextron Systems)","status":"experimental","level":"high","date":"2026-03-09","modified":null,"description":"Detects the use of Python's base64 decoding functions in command line executions on Linux systems.\nMalicious scripts often use python one-liners to decode and execute base64-encoded payloads, which is a common technique for obfuscation and evasion.\n","references":["https://docs.python.org/3/library/base64.html","https://www.virustotal.com/gui/file/bc43e925d7b4b74319f6e74e836a96f1997ba404e14ac566cf12a21e9da463db/behavior","https://cloud.google.com/blog/topics/threat-intelligence/cybercriminals-weaponize-fake-ai-websites"],"logsource":{"product":"linux","category":"process_creation"},"tags":["attack.execution","attack.stealth","attack.t1059.006","attack.t1027.010"],"path":"rules/linux/process_creation/proc_creation_lnx_python_base64_encoded_execution.yml","techniques":["T1059.006","T1027.010"],"cves":[]},{"id":"7a1b4c5e-8f3d-4b9a-7c2e-1f4a5b8c6d9e","title":"Suspicious Space Characters in RunMRU Registry Path - ClickFix","author":"Swachchhanda Shrawan Poudel (Nextron Systems)","status":"experimental","level":"high","date":"2025-11-04","modified":null,"description":"Detects the occurrence of numerous space characters in RunMRU registry paths, which may indicate execution via phishing lures using clickfix techniques to hide malicious commands in the Windows Run dialog box from naked eyes.\n","references":["https://expel.com/blog/cache-smuggling-when-a-picture-isnt-a-thousand-words/","https://github.com/JohnHammond/recaptcha-phish"],"logsource":{"product":"windows","category":"registry_set"},"tags":["attack.execution","attack.stealth","attack.t1204.004","attack.t1027.010"],"path":"rules/windows/registry/registry_set/registry_set_susp_runmru_space_character.yml","techniques":["T1204.004","T1027.010"],"cves":[]},{"id":"7b6a7418-3afc-11f0-aff4-000d3abf478c","title":"Obfuscated PowerShell MSI Install via WindowsInstaller COM","author":"Meroujan Antonyan (vx3r)","status":"experimental","level":"high","date":"2025-05-27","modified":null,"description":"Detects the execution of obfuscated PowerShell commands that attempt to install MSI packages via the Windows Installer COM object (`WindowsInstaller.Installer`).\nThe technique involves manipulating strings to hide functionality, such as constructing class names using string insertion (e.g., 'indowsInstaller.Installer'.Insert(0,'W')) and correcting\nmalformed URLs (e.g., converting 'htps://' to 'https://') at runtime. This behavior is commonly associated with malware loaders or droppers that aim to bypass static detection\nby hiding intent in runtime-generated strings and using legitimate tools for code execution. The use of `InstallProduct` and COM object creation, particularly combined with\nhidden window execution and suppressed UI, indicates an attempt to install software (likely malicious) without user interaction.\n","references":["https://informationsecuritybuzz.com/the-real-danger-behind-a-simple-windows-shortcut/","https://redcanary.com/blog/threat-intelligence/intelligence-insights-may-2025/","https://www.virustotal.com/gui/file/f9710b0ba4de5fa0e7ec27da462d4d2fc6838eba83a19f23f6617a466bbad457"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.stealth","attack.t1027.010","attack.t1218.007","attack.execution","attack.t1059.001"],"path":"rules/windows/process_creation/proc_creation_win_powershell_comobject_msi.yml","techniques":["T1027.010","T1218.007","T1059.001"],"cves":[]},{"id":"8f2a5c3d-9e4b-4a7c-8d1f-2e5a6b9c3d7e","title":"Suspicious Space Characters in TypedPaths Registry Path - FileFix","author":"Swachchhanda Shrawan Poudel (Nextron Systems)","status":"experimental","level":"high","date":"2025-11-04","modified":null,"description":"Detects the occurrence of numerous space characters in TypedPaths registry paths, which may indicate execution via phishing lures using file-fix techniques to hide malicious commands.\n","references":["https://expel.com/blog/cache-smuggling-when-a-picture-isnt-a-thousand-words/","https://mrd0x.com/filefix-clickfix-alternative/"],"logsource":{"product":"windows","category":"registry_set"},"tags":["attack.execution","attack.stealth","attack.t1204.004","attack.t1027.010"],"path":"rules/windows/registry/registry_set/registry_set_susp_typedpaths_space_characters.yml","techniques":["T1204.004","T1027.010"],"cves":[]},{"id":"ad856965-f44d-42a8-945e-bbf7bd03d05a","title":"Invocation Of Crypto-Classes From The \"Cryptography\" PowerShell Namespace","author":"Andreas Braathen (mnemonic.io)","status":"test","level":"medium","date":"2023-12-01","modified":null,"description":"Detects the invocation of PowerShell commands with references to classes from the \"System.Security.Cryptography\" namespace.\nThe PowerShell namespace \"System.Security.Cryptography\" provides classes for on-the-fly encryption and decryption.\nThese can be used for example in decrypting malicious payload for defense evasion.\n","references":["https://learn.microsoft.com/en-us/dotnet/api/system.security.cryptography?view=net-8.0","https://blogs.vmware.com/security/2023/11/jupyter-rising-an-update-on-jupyter-infostealer.html","https://www.virustotal.com/gui/file/39102fb7bb6a74a9c8cb6d46419f9015b381199ea8524c1376672b30fffd69d2"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.execution","attack.stealth","attack.t1059.001","attack.t1027.010","detection.threat-hunting"],"path":"rules-threat-hunting/windows/process_creation/proc_creation_win_powershell_crypto_namespace.yml","techniques":["T1059.001","T1027.010"],"cves":[]}],"kev_cves":[],"_built":"2026-08-23 05:47 UTC","_attack_version":"19.2","_sigma_commit":"da9bb07d642a2826e89702445d32c795209ec108"}