{"id":"T1027","name":"Obfuscated Files or Information","url":"https://attack.mitre.org/techniques/T1027","tactics":["stealth"],"platforms":["ESXi","Linux","macOS","Network Devices","Windows"],"live":true,"revoked":false,"deprecated":false,"revoked_by":null,"detection_strategies":[{"id":"DET0378","stix_id":"x-mitre-detection-strategy--e3758cbb-5dd9-4aad-b848-0539a8c56307","name":"Behavioral Detection of Obfuscated Files or Information","url":"https://attack.mitre.org/detectionstrategies/DET0378","analytics":[{"id":"AN1064","stix_id":"x-mitre-analytic--1dee558e-720e-4f3b-9414-192a63eb8909","name":"Analytic 1064","description":"Correlates script execution or suspicious parent processes with creation or modification of encoded, compressed, or encrypted file formats (e.g., .zip, .7z, .enc) and abnormal command-line syntax or PowerShell obfuscation.","url":"https://attack.mitre.org/detectionstrategies/DET0378#AN1064","platforms":["Windows"],"log_source_references":[{"name":"WinEventLog:Security","channel":"EventCode=4688","data_component":"DC0032","data_component_name":"Process Creation","log_source_slug":"wineventlog-security"},{"name":"WinEventLog:Sysmon","channel":"EventCode=11","data_component":"DC0039","data_component_name":"File Creation","log_source_slug":"wineventlog-sysmon"},{"name":"WinEventLog:Sysmon","channel":"EventCode=1","data_component":"DC0032","data_component_name":"Process Creation","log_source_slug":"wineventlog-sysmon"}],"mutable_elements":[{"field":"PayloadEntropyThreshold","description":"Tune entropy threshold to distinguish obfuscation from legitimate compression"},{"field":"TimeWindow","description":"Adjust correlation window between script execution and encoded file creation"},{"field":"SuspiciousParentProcessList","description":"Customize based on environment to include LOLBins or admin tools misused for obfuscation"}],"live":true,"detection_strategies":["DET0378"],"techniques":["T1027"]},{"id":"AN1065","stix_id":"x-mitre-analytic--3e7ff1f9-57e2-44f4-8dc1-20d1a1652f73","name":"Analytic 1065","description":"Detects use of gzip, base64, tar, or openssl in scripts or commands that encode/encrypt files after file staging or system enumeration.","url":"https://attack.mitre.org/detectionstrategies/DET0378#AN1065","platforms":["Linux"],"log_source_references":[{"name":"auditd:SYSCALL","channel":"execve","data_component":"DC0032","data_component_name":"Process Creation","log_source_slug":"auditd-syscall"},{"name":"auditd:SYSCALL","channel":"open, write","data_component":"DC0061","data_component_name":"File Modification","log_source_slug":"auditd-syscall"},{"name":"linux:cli","channel":"Shell history logs","data_component":"DC0064","data_component_name":"Command Execution","log_source_slug":"linux-cli"}],"mutable_elements":[{"field":"CommandRegex","description":"Customize for tools seen in environment (e.g., gzip, bzip2, xz)"},{"field":"SensitivePathList","description":"Specify file paths likely targeted for obfuscation (e.g., /etc/, /home/)"}],"live":true,"detection_strategies":["DET0378"],"techniques":["T1027"]},{"id":"AN1066","stix_id":"x-mitre-analytic--1c2e527f-b9ff-4e1d-896d-0c1257f0abc1","name":"Analytic 1066","description":"Monitors use of archive or encryption tools (zip, openssl) tied to user-scripted activity or binaries writing encoded payloads under /Users or /Volumes.","url":"https://attack.mitre.org/detectionstrategies/DET0378#AN1066","platforms":["macOS"],"log_source_references":[{"name":"macos:unifiedlog","channel":"log stream --predicate 'processImagePath contains \"zip\" OR \"base64\"'","data_component":"DC0064","data_component_name":"Command Execution","log_source_slug":"macos-unifiedlog"},{"name":"macos:osquery","channel":"file_events","data_component":"DC0039","data_component_name":"File Creation","log_source_slug":"macos-osquery"}],"mutable_elements":[{"field":"FilenameExtensionList","description":"Tunable to identify uncommon or encrypted file formats (e.g., .enc, .b64, .xz)"},{"field":"UserContext","description":"Tune to prioritize unexpected file access by service accounts"}],"live":true,"detection_strategies":["DET0378"],"techniques":["T1027"]},{"id":"AN1067","stix_id":"x-mitre-analytic--97a188cf-5851-4cb7-9bb5-17702707d52b","name":"Analytic 1067","description":"Identifies transfer of base64, uuencoded, or high-entropy files over HTTP, FTP, or custom protocols in lateral movement or exfiltration streams.","url":"https://attack.mitre.org/detectionstrategies/DET0378#AN1067","platforms":["Network Devices"],"log_source_references":[{"name":"networkdevice:IDS","channel":"content inspection / PCAP / HTTP body","data_component":"DC0085","data_component_name":"Network Traffic Content","log_source_slug":"networkdevice-ids"}],"mutable_elements":[{"field":"EntropyThreshold","description":"Adjust threshold to reduce false positives in compressed but benign data"},{"field":"ProtocolScope","description":"Refine by enabling inspection of specific exfil vectors (e.g., FTP, HTTP POST)"}],"live":true,"detection_strategies":["DET0378"],"techniques":["T1027"]},{"id":"AN1068","stix_id":"x-mitre-analytic--f1ec63bc-294c-471c-ae9f-4dd70f3c036a","name":"Analytic 1068","description":"Detects encoded PowerCLI or Base64-encoded payloads staged via datastore uploads or shell access (e.g., ESXi Shell or backdoored VIBs).","url":"https://attack.mitre.org/detectionstrategies/DET0378#AN1068","platforms":["ESXi"],"log_source_references":[{"name":"esxi:vmkernel","channel":"Datastore modification events","data_component":"DC0059","data_component_name":"File Metadata","log_source_slug":"esxi-vmkernel"},{"name":"esxi:hostd","channel":"Remote access API calls and file uploads","data_component":"DC0021","data_component_name":"OS API Execution","log_source_slug":"esxi-hostd"}],"mutable_elements":[{"field":"StagingLocation","description":"Tune based on observed adversary paths (e.g., /vmfs/volumes/...)"},{"field":"EncodedLengthThreshold","description":"Tune length of encoded payloads before triggering detection"}],"live":true,"detection_strategies":["DET0378"],"techniques":["T1027"]}],"live":true,"version":"1.0","techniques":["T1027"]}],"sigma_rules":[{"id":"00ba9da1-b510-4f6b-b258-8d338836180f","title":"Password Protected ZIP File Opened","author":"Florian Roth (Nextron Systems)","status":"test","level":"medium","date":"2022-05-09","modified":null,"description":"Detects the extraction of password protected ZIP archives. See the filename variable for more details on which file has been opened.","references":["https://twitter.com/sbousseaden/status/1523383197513379841"],"logsource":{"product":"windows","service":"security"},"tags":["attack.stealth","attack.t1027"],"path":"rules/windows/builtin/security/win_security_susp_opened_encrypted_zip.yml","techniques":["T1027"],"cves":[]},{"id":"07ad2ea8-6a55-4ac6-bf3e-91b8e59676eb","title":"Invoke-Obfuscation Via Use MSHTA - PowerShell Module","author":"Nikita Nazarov, oscd.community","status":"test","level":"high","date":"2020-10-08","modified":"2023-01-04","description":"Detects Obfuscated Powershell via use MSHTA in Scripts","references":["https://github.com/SigmaHQ/sigma/issues/1009"],"logsource":{"product":"windows","category":"ps_module"},"tags":["attack.stealth","attack.t1027","attack.execution","attack.t1059.001"],"path":"rules/windows/powershell/powershell_module/posh_pm_invoke_obfuscation_via_use_mhsta.yml","techniques":["T1027","T1059.001"],"cves":[]},{"id":"0adfbc14-0ed1-11eb-adc1-0242ac120002","title":"Invoke-Obfuscation VAR+ Launcher - PowerShell","author":"Jonathan Cheong, oscd.community","status":"test","level":"high","date":"2020-10-15","modified":"2024-04-05","description":"Detects Obfuscated use of Environment Variables to execute PowerShell","references":["https://github.com/SigmaHQ/sigma/issues/1009"],"logsource":{"product":"windows","category":"ps_script"},"tags":["attack.stealth","attack.t1027","attack.execution","attack.t1059.001"],"path":"rules/windows/powershell/powershell_script/posh_ps_invoke_obfuscation_var.yml","techniques":["T1027","T1059.001"],"cves":[]},{"id":"0c3fac91-5627-46e8-a6a8-a0d7b9b8ae1b","title":"Suspicious Get-Variable.exe Creation","author":"frack113","status":"test","level":"high","date":"2022-04-23","modified":null,"description":"Get-Variable is a valid PowerShell cmdlet\nWindowsApps is by default in the path where PowerShell is executed.\nSo when the Get-Variable command is issued on PowerShell execution, the system first looks for the Get-Variable executable in the path and executes the malicious binary instead of looking for the PowerShell cmdlet.\n","references":["https://blog.malwarebytes.com/threat-intelligence/2022/04/colibri-loader-combines-task-scheduler-and-powershell-in-clever-persistence-technique/","https://www.joesandbox.com/analysis/465533/0/html"],"logsource":{"product":"windows","category":"file_event"},"tags":["attack.privilege-escalation","attack.persistence","attack.stealth","attack.t1546","attack.t1027"],"path":"rules/windows/file/file_event/file_event_win_susp_get_variable.yml","techniques":["T1546","T1027"],"cves":[]},{"id":"0c718a5e-4284-4fb9-b4d9-b9a50b3a1974","title":"Invoke-Obfuscation STDIN+ Launcher - Security","author":"Jonathan Cheong, oscd.community","status":"test","level":"high","date":"2020-10-15","modified":"2022-11-29","description":"Detects Obfuscated use of stdin to execute PowerShell","references":["https://github.com/SigmaHQ/sigma/issues/1009"],"logsource":{"product":"windows","service":"security"},"tags":["attack.stealth","attack.t1027","attack.execution","attack.t1059.001"],"path":"rules/windows/builtin/security/win_security_invoke_obfuscation_stdin_services_security.yml","techniques":["T1027","T1059.001"],"cves":[]},{"id":"0c92f2e6-f08f-4b73-9216-ecb0ca634689","title":"PUA - Potential PE Metadata Tamper Using Rcedit","author":"Micah Babinski","status":"test","level":"medium","date":"2022-12-11","modified":"2023-03-05","description":"Detects the use of rcedit to potentially alter executable PE metadata properties, which could conceal efforts to rename system utilities for defense evasion.","references":["https://security.stackexchange.com/questions/210843/is-it-possible-to-change-original-filename-of-an-exe","https://www.virustotal.com/gui/file/02e8e8c5d430d8b768980f517b62d7792d690982b9ba0f7e04163cbc1a6e7915","https://github.com/electron/rcedit"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.stealth","attack.t1036.003","attack.t1036","attack.t1027.005","attack.t1027"],"path":"rules/windows/process_creation/proc_creation_win_pua_rcedit_execution.yml","techniques":["T1036.003","T1036","T1027.005","T1027"],"cves":[]},{"id":"11629c4d-0fe6-465b-be62-b39a1c442aad","title":"Potentially Suspicious Long Filename Pattern - Linux","author":"@kostastsale","status":"experimental","level":"low","date":"2025-11-22","modified":null,"description":"Detects the creation of files with unusually long filenames (100 or more characters), which may indicate obfuscation techniques used by malware such as VShell.\nThis is a hunting rule to identify potential threats that use long filenames to evade detection. Keep in mind that on a legitimate system, such long filenames can and are common. Run this detection in the context of threat hunting rather than alerting.\nAdjust the threshold of filename length as needed based on your environment.\n","references":["https://www.trellix.com/blogs/research/the-silent-fileless-threat-of-vshell/"],"logsource":{"product":"linux","category":"file_event"},"tags":["attack.execution","attack.stealth","attack.t1059.004","attack.t1027","detection.threat-hunting"],"path":"rules-threat-hunting/linux/file/file_event/file_event_lnx_susp_long_filename_pattern.yml","techniques":["T1059.004","T1027"],"cves":[]},{"id":"11b52f18-aaec-4d60-9143-5dd8cc4706b9","title":"Invoke-Obfuscation RUNDLL LAUNCHER - System","author":"Timur Zinniatullin, oscd.community","status":"test","level":"medium","date":"2020-10-18","modified":"2022-11-29","description":"Detects Obfuscated Powershell via RUNDLL LAUNCHER","references":["https://github.com/SigmaHQ/sigma/issues/1009"],"logsource":{"product":"windows","service":"system"},"tags":["attack.stealth","attack.t1027","attack.execution","attack.t1059.001"],"path":"rules/windows/builtin/system/service_control_manager/win_system_invoke_obfuscation_via_rundll_services.yml","techniques":["T1027","T1059.001"],"cves":[]},{"id":"130c9e58-28ac-4f83-8574-0a4cc913b97e","title":"Potential Winnti Dropper Activity","author":"Alexander Rausch","status":"test","level":"high","date":"2020-06-24","modified":"2023-01-05","description":"Detects files dropped by Winnti as described in RedMimicry Winnti playbook","references":["https://redmimicry.com/posts/redmimicry-winnti/#dropper"],"logsource":{"product":"windows","category":"file_event"},"tags":["attack.stealth","attack.t1027"],"path":"rules/windows/file/file_event/file_event_win_redmimicry_winnti_filedrop.yml","techniques":["T1027"],"cves":[]},{"id":"13e6fe51-d478-4c7e-b0f2-6da9b400a829","title":"Suspicious File Downloaded From Direct IP Via Certutil.EXE","author":"Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"high","date":"2023-02-15","modified":"2025-12-01","description":"Detects the execution of certutil with certain flags that allow the utility to download files from direct IPs.","references":["https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/certutil","https://forensicitguy.github.io/agenttesla-vba-certutil-download/","https://news.sophos.com/en-us/2021/04/13/compromised-exchange-server-hosting-cryptojacker-targeting-other-exchange-servers/","https://twitter.com/egre55/status/1087685529016193025","https://lolbas-project.github.io/lolbas/Binaries/Certutil/","https://twitter.com/_JohnHammond/status/1708910264261980634","https://www.hexacorn.com/blog/2020/08/23/certutil-one-more-gui-lolbin"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.stealth","attack.t1027","attack.command-and-control","attack.t1105"],"path":"rules/windows/process_creation/proc_creation_win_certutil_download_direct_ip.yml","techniques":["T1027","T1105"],"cves":[]},{"id":"14bcba49-a428-42d9-b943-e2ce0f0f7ae6","title":"Invoke-Obfuscation VAR++ LAUNCHER OBFUSCATION - System","author":"Timur Zinniatullin, oscd.community","status":"test","level":"high","date":"2020-10-13","modified":"2022-11-29","description":"Detects Obfuscated Powershell via VAR++ LAUNCHER","references":["https://github.com/SigmaHQ/sigma/issues/1009"],"logsource":{"product":"windows","service":"system"},"tags":["attack.stealth","attack.t1027","attack.execution","attack.t1059.001"],"path":"rules/windows/builtin/system/service_control_manager/win_system_invoke_obfuscation_via_var_services.yml","techniques":["T1027","T1059.001"],"cves":[]},{"id":"175997c5-803c-4b08-8bb0-70b099f47595","title":"Invoke-Obfuscation COMPRESS OBFUSCATION - System","author":"Timur Zinniatullin, oscd.community","status":"test","level":"medium","date":"2020-10-18","modified":"2022-11-29","description":"Detects Obfuscated Powershell via COMPRESS OBFUSCATION","references":["https://github.com/SigmaHQ/sigma/issues/1009"],"logsource":{"product":"windows","service":"system"},"tags":["attack.stealth","attack.t1027","attack.execution","attack.t1059.001"],"path":"rules/windows/builtin/system/service_control_manager/win_system_invoke_obfuscation_via_compress_services.yml","techniques":["T1027","T1059.001"],"cves":[]},{"id":"179b3686-6271-4d87-807d-17d843a8af73","title":"Suspicious Filename with Embedded Base64 Commands","author":"@kostastsale","status":"experimental","level":"high","date":"2025-11-22","modified":null,"description":"Detects files with specially crafted filenames that embed Base64-encoded bash payloads designed to execute when processed by shell scripts.\nThese filenames exploit shell interpretation quirks to trigger hidden commands, a technique observed in VShell malware campaigns.\n","references":["https://www.trellix.com/blogs/research/the-silent-fileless-threat-of-vshell/"],"logsource":{"product":"linux","category":"file_event"},"tags":["attack.execution","attack.stealth","attack.t1059.004","attack.t1027"],"path":"rules/linux/file_event/file_event_lnx_susp_filename_with_embedded_base64_command.yml","techniques":["T1059.004","T1027"],"cves":[]},{"id":"1816994b-42e1-4fb1-afd2-134d88184f71","title":"PowerShell Base64 Encoded WMI Classes","author":"Christian Burkard (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"high","date":"2023-01-30","modified":null,"description":"Detects calls to base64 encoded WMI class such as \"Win32_ShadowCopy\", \"Win32_ScheduledJob\", etc.","references":["https://github.com/Neo23x0/Raccine/blob/20a569fa21625086433dcce8bb2765d0ea08dcb6/yara/mal_revil.yar"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.execution","attack.stealth","attack.t1059.001","attack.t1027"],"path":"rules/windows/process_creation/proc_creation_win_powershell_base64_wmi_classes.yml","techniques":["T1059.001","T1027"],"cves":[]},{"id":"19b08b1c-861d-4e75-a1ef-ea0c1baf202b","title":"Suspicious Download Via Certutil.EXE","author":"Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community, Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"medium","date":"2023-02-15","modified":"2025-12-01","description":"Detects the execution of certutil with certain flags that allow the utility to download files.","references":["https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/certutil","https://forensicitguy.github.io/agenttesla-vba-certutil-download/","https://news.sophos.com/en-us/2021/04/13/compromised-exchange-server-hosting-cryptojacker-targeting-other-exchange-servers/","https://twitter.com/egre55/status/1087685529016193025","https://lolbas-project.github.io/lolbas/Binaries/Certutil/","https://www.hexacorn.com/blog/2020/08/23/certutil-one-more-gui-lolbin"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.stealth","attack.t1027","attack.command-and-control","attack.t1105"],"path":"rules/windows/process_creation/proc_creation_win_certutil_download.yml","techniques":["T1027","T1105"],"cves":[]},{"id":"1a0a2ff1-611b-4dac-8216-8a7b47c618a6","title":"Invoke-Obfuscation Via Use Clip - Security","author":"Nikita Nazarov, oscd.community","status":"test","level":"high","date":"2020-10-09","modified":"2022-11-29","description":"Detects Obfuscated Powershell via use Clip.exe in Scripts","references":["https://github.com/SigmaHQ/sigma/issues/1009"],"logsource":{"product":"windows","service":"security"},"tags":["attack.stealth","attack.t1027","attack.execution","attack.t1059.001"],"path":"rules/windows/builtin/security/win_security_invoke_obfuscation_via_use_clip_services_security.yml","techniques":["T1027","T1059.001"],"cves":[]},{"id":"1a0d4aba-7668-4365-9ce4-6d79ab088dfd","title":"Ping Hex IP","author":"Florian Roth (Nextron Systems)","status":"test","level":"high","date":"2018-03-23","modified":"2025-10-17","description":"Detects a ping command that uses a hex encoded IP address","references":["https://github.com/vysecurity/Aggressor-VYSEC/blob/0d61c80387b9432dab64b8b8a9fb52d20cfef80e/ping.cna","https://twitter.com/vysecurity/status/977198418354491392"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.stealth","attack.t1140","attack.t1027"],"path":"rules/windows/process_creation/proc_creation_win_ping_hex_ip.yml","techniques":["T1140","T1027"],"cves":[]},{"id":"1b9dc62e-6e9e-42a3-8990-94d7a10007f7","title":"Invoke-Obfuscation Obfuscated IEX Invocation - PowerShell","author":"Daniel Bohannon (@Mandiant/@FireEye), oscd.community","status":"test","level":"high","date":"2019-11-08","modified":"2022-12-31","description":"Detects all variations of obfuscated powershell IEX invocation code generated by Invoke-Obfuscation framework from the following code block \\u2014","references":["https://github.com/danielbohannon/Invoke-Obfuscation/blob/f20e7f843edd0a3a7716736e9eddfa423395dd26/Out-ObfuscatedStringCommand.ps1#L873-L888"],"logsource":{"product":"windows","category":"ps_script"},"tags":["attack.stealth","attack.t1027","attack.execution","attack.t1059.001"],"path":"rules/windows/powershell/powershell_script/posh_ps_invoke_obfuscation_obfuscated_iex.yml","techniques":["T1027","T1059.001"],"cves":[]},{"id":"1cfac73c-be78-4f9a-9b08-5bde0c3953ab","title":"Operation Wocao Activity","author":"Florian Roth (Nextron Systems), frack113","status":"test","level":"high","date":"2019-12-20","modified":"2022-10-09","description":"Detects activity mentioned in Operation Wocao report","references":["https://www.fox-it.com/en/news/whitepapers/operation-wocao-shining-a-light-on-one-of-chinas-hidden-hacking-groups/","https://twitter.com/SBousseaden/status/1207671369963646976"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.privilege-escalation","attack.persistence","attack.discovery","attack.stealth","attack.t1012","attack.t1036.004","attack.t1027","attack.execution","attack.t1053.005","attack.t1059.001","detection.emerging-threats"],"path":"rules-emerging-threats/2019/TA/Operation-Wocao/proc_creation_win_apt_wocao.yml","techniques":["T1012","T1036.004","T1027","T1053.005","T1059.001"],"cves":[]},{"id":"20e5497e-331c-4cd5-8d36-935f6e2a9a07","title":"Invoke-Obfuscation COMPRESS OBFUSCATION - PowerShell","author":"Timur Zinniatullin, oscd.community","status":"test","level":"medium","date":"2020-10-18","modified":"2022-11-29","description":"Detects Obfuscated Powershell via COMPRESS OBFUSCATION","references":["https://github.com/SigmaHQ/sigma/issues/1009"],"logsource":{"product":"windows","category":"ps_script"},"tags":["attack.stealth","attack.t1027","attack.execution","attack.t1059.001"],"path":"rules/windows/powershell/powershell_script/posh_ps_invoke_obfuscation_via_compress.yml","techniques":["T1027","T1059.001"],"cves":[]},{"id":"2617e7ed-adb7-40ba-b0f3-8f9945fe6c09","title":"Suspicious SYSTEM User Process Creation","author":"Florian Roth (Nextron Systems), David ANDRE (additional keywords)","status":"test","level":"high","date":"2021-12-20","modified":"2025-10-19","description":"Detects a suspicious process creation as SYSTEM user (suspicious program or command line parameter)","references":["Internal Research","https://tools.thehacker.recipes/mimikatz/modules"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.credential-access","attack.privilege-escalation","attack.stealth","attack.t1134","attack.t1003","attack.t1027"],"path":"rules/windows/process_creation/proc_creation_win_susp_system_user_anomaly.yml","techniques":["T1134","T1003","T1027"],"cves":[]},{"id":"27aec9c9-dbb0-4939-8422-1742242471d0","title":"Invoke-Obfuscation VAR+ Launcher","author":"Jonathan Cheong, oscd.community","status":"test","level":"high","date":"2020-10-15","modified":"2024-04-15","description":"Detects Obfuscated use of Environment Variables to execute PowerShell","references":["https://github.com/SigmaHQ/sigma/issues/1009"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.stealth","attack.t1027","attack.execution","attack.t1059.001"],"path":"rules/windows/process_creation/proc_creation_win_hktl_invoke_obfuscation_var.yml","techniques":["T1027","T1059.001"],"cves":[]},{"id":"2f211361-7dce-442d-b78a-c04039677378","title":"Invoke-Obfuscation Obfuscated IEX Invocation - PowerShell Module","author":"Daniel Bohannon (@Mandiant/@FireEye), oscd.community","status":"test","level":"high","date":"2019-11-08","modified":"2022-12-31","description":"Detects all variations of obfuscated powershell IEX invocation code generated by Invoke-Obfuscation framework from the code block cited in the reference section below","references":["https://github.com/danielbohannon/Invoke-Obfuscation/blob/f20e7f843edd0a3a7716736e9eddfa423395dd26/Out-ObfuscatedStringCommand.ps1#L873-L888"],"logsource":{"product":"windows","category":"ps_module"},"tags":["attack.stealth","attack.t1027","attack.execution","attack.t1059.001"],"path":"rules/windows/powershell/powershell_module/posh_pm_invoke_obfuscation_obfuscated_iex.yml","techniques":["T1027","T1059.001"],"cves":[]},{"id":"3ffd6f51-e6c1-47b7-94b4-c1e61d4117c5","title":"Certificate Exported Via Certutil.EXE","author":"Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community, Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"medium","date":"2023-02-15","modified":"2024-03-05","description":"Detects the execution of the certutil with the \"exportPFX\" flag which allows the utility to export certificates.","references":["https://www.splunk.com/en_us/blog/security/a-golden-saml-journey-solarwinds-continued.html"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.stealth","attack.t1027"],"path":"rules/windows/process_creation/proc_creation_win_certutil_export_pfx.yml","techniques":["T1027"],"cves":[]},{"id":"42a5f1e7-9603-4f6d-97ae-3f37d130d794","title":"Suspicious File Downloaded From File-Sharing Website Via Certutil.EXE","author":"Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"high","date":"2023-02-15","modified":"2026-03-29","description":"Detects the execution of certutil with certain flags that allow the utility to download files from file-sharing websites.","references":["https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/certutil","https://forensicitguy.github.io/agenttesla-vba-certutil-download/","https://news.sophos.com/en-us/2021/04/13/compromised-exchange-server-hosting-cryptojacker-targeting-other-exchange-servers/","https://twitter.com/egre55/status/1087685529016193025","https://lolbas-project.github.io/lolbas/Binaries/Certutil/","https://www.microsoft.com/en-us/security/blog/2024/01/17/new-ttps-observed-in-mint-sandstorm-campaign-targeting-high-profile-individuals-at-universities-and-research-orgs/","https://www.hexacorn.com/blog/2020/08/23/certutil-one-more-gui-lolbin"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.stealth","attack.t1027","attack.command-and-control","attack.t1105"],"path":"rules/windows/process_creation/proc_creation_win_certutil_download_file_sharing_domains.yml","techniques":["T1027","T1105"],"cves":[]},{"id":"487c7524-f892-4054-b263-8a0ace63fc25","title":"Invoke-Obfuscation Via Stdin - System","author":"Nikita Nazarov, oscd.community","status":"test","level":"high","date":"2020-10-12","modified":"2022-11-29","description":"Detects Obfuscated Powershell via Stdin in Scripts","references":["https://github.com/SigmaHQ/sigma/issues/1009"],"logsource":{"product":"windows","service":"system"},"tags":["attack.stealth","attack.t1027","attack.execution","attack.t1059.001"],"path":"rules/windows/builtin/system/service_control_manager/win_system_invoke_obfuscation_via_stdin_services.yml","techniques":["T1027","T1059.001"],"cves":[]},{"id":"4bf943c6-5146-4273-98dd-e958fd1e3abf","title":"Invoke-Obfuscation Obfuscated IEX Invocation","author":"Daniel Bohannon (@Mandiant/@FireEye), oscd.community","status":"test","level":"high","date":"2019-11-08","modified":"2026-03-16","description":"Detects all variations of obfuscated powershell IEX invocation code generated by Invoke-Obfuscation framework from the following code block","references":["https://github.com/danielbohannon/Invoke-Obfuscation/blob/f20e7f843edd0a3a7716736e9eddfa423395dd26/Out-ObfuscatedStringCommand.ps1#L873-L888"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.stealth","attack.t1027","attack.execution","attack.t1059.001"],"path":"rules/windows/process_creation/proc_creation_win_hktl_invoke_obfuscation_obfuscated_iex_commandline.yml","techniques":["T1027","T1059.001"],"cves":[]},{"id":"4c54ba8f-73d2-4d40-8890-d9cf1dca3d30","title":"Invoke-Obfuscation VAR++ LAUNCHER OBFUSCATION - Security","author":"Timur Zinniatullin, oscd.community","status":"test","level":"high","date":"2020-10-13","modified":"2022-11-29","description":"Detects Obfuscated Powershell via VAR++ LAUNCHER","references":["https://github.com/SigmaHQ/sigma/issues/1009"],"logsource":{"product":"windows","service":"security"},"tags":["attack.stealth","attack.t1027","attack.execution","attack.t1059.001"],"path":"rules/windows/builtin/security/win_security_invoke_obfuscation_via_var_services_security.yml","techniques":["T1027","T1059.001"],"cves":[]},{"id":"4edf51e1-cb83-4e1a-bc39-800e396068e3","title":"Invoke-Obfuscation CLIP+ Launcher - Security","author":"Jonathan Cheong, oscd.community","status":"test","level":"high","date":"2020-10-13","modified":"2022-11-27","description":"Detects Obfuscated use of Clip.exe to execute PowerShell","references":["https://github.com/SigmaHQ/sigma/issues/1009"],"logsource":{"product":"windows","service":"security"},"tags":["attack.stealth","attack.t1027","attack.execution","attack.t1059.001"],"path":"rules/windows/builtin/security/win_security_invoke_obfuscation_clip_services_security.yml","techniques":["T1027","T1059.001"],"cves":[]},{"id":"51aa9387-1c53-4153-91cc-d73c59ae1ca9","title":"Invoke-Obfuscation Obfuscated IEX Invocation - System","author":"Daniel Bohannon (@Mandiant/@FireEye), oscd.community","status":"test","level":"high","date":"2019-11-08","modified":"2022-11-27","description":"Detects all variations of obfuscated powershell IEX invocation code generated by Invoke-Obfuscation framework from the code block linked in the references","references":["https://github.com/danielbohannon/Invoke-Obfuscation/blob/f20e7f843edd0a3a7716736e9eddfa423395dd26/Out-ObfuscatedStringCommand.ps1#L873-L888"],"logsource":{"product":"windows","service":"system"},"tags":["attack.stealth","attack.t1027"],"path":"rules/windows/builtin/system/service_control_manager/win_system_invoke_obfuscation_obfuscated_iex_services.yml","techniques":["T1027"],"cves":[]},{"id":"54f0434b-726f-48a1-b2aa-067df14516e4","title":"Password Protected ZIP File Opened (Suspicious Filenames)","author":"Florian Roth (Nextron Systems)","status":"test","level":"high","date":"2022-05-09","modified":null,"description":"Detects the extraction of password protected ZIP archives with suspicious file names. See the filename variable for more details on which file has been opened.","references":["https://twitter.com/sbousseaden/status/1523383197513379841"],"logsource":{"product":"windows","service":"security"},"tags":["attack.command-and-control","attack.stealth","attack.t1027","attack.t1105","attack.t1036"],"path":"rules/windows/builtin/security/win_security_susp_opened_encrypted_zip_filename.yml","techniques":["T1027","T1105","T1036"],"cves":[]},{"id":"571498c8-908e-40b4-910b-d2369159a3da","title":"Password Protected ZIP File Opened (Email Attachment)","author":"Florian Roth (Nextron Systems)","status":"test","level":"high","date":"2022-05-09","modified":null,"description":"Detects the extraction of password protected ZIP archives. See the filename variable for more details on which file has been opened.","references":["https://twitter.com/sbousseaden/status/1523383197513379841"],"logsource":{"product":"windows","service":"security"},"tags":["attack.initial-access","attack.stealth","attack.t1027","attack.t1566.001"],"path":"rules/windows/builtin/security/win_security_susp_opened_encrypted_zip_outlook.yml","techniques":["T1027","T1566.001"],"cves":[]},{"id":"584bca0f-3608-4402-80fd-4075ff6072e3","title":"Potential CommandLine Obfuscation Using Unicode Characters From Suspicious Image","author":"frack113, Florian Roth (Nextron Systems), Josh Nickels","status":"test","level":"high","date":"2024-09-02","modified":"2025-05-30","description":"Detects potential commandline obfuscation using unicode characters.\nAdversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit.\n","references":["https://www.wietzebeukema.nl/blog/windows-command-line-obfuscation","https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1027/T1027.md#atomic-test-6---dlp-evasion-via-sensitive-data-in-vba-macro-over-http"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.stealth","attack.t1027"],"path":"rules/windows/process_creation/proc_creation_win_susp_cli_obfuscation_unicode_img.yml","techniques":["T1027"],"cves":[]},{"id":"62b7ccc9-23b4-471e-aa15-6da3663c4d59","title":"PowerShell Base64 Encoded Reflective Assembly Load","author":"Christian Burkard (Nextron Systems), pH-T (Nextron Systems)","status":"test","level":"high","date":"2022-03-01","modified":"2023-01-30","description":"Detects base64 encoded .NET reflective loading of Assembly","references":["https://github.com/Neo23x0/Raccine/blob/20a569fa21625086433dcce8bb2765d0ea08dcb6/yara/mal_revil.yar","https://thedfirreport.com/2022/05/09/seo-poisoning-a-gootloader-story/"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.execution","attack.stealth","attack.t1059.001","attack.t1027","attack.t1620"],"path":"rules/windows/process_creation/proc_creation_win_powershell_base64_reflection_assembly_load.yml","techniques":["T1059.001","T1027","T1620"],"cves":[]},{"id":"6385697e-9f1b-40bd-8817-f4a91f40508e","title":"PowerShell Base64 Encoded Invoke Keyword","author":"pH-T (Nextron Systems), Harjot Singh, @cyb3rjy0t","status":"test","level":"high","date":"2022-05-20","modified":"2023-04-06","description":"Detects UTF-8 and UTF-16 Base64 encoded powershell 'Invoke-' calls","references":["https://thedfirreport.com/2022/05/09/seo-poisoning-a-gootloader-story/"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.execution","attack.stealth","attack.t1059.001","attack.t1027"],"path":"rules/windows/process_creation/proc_creation_win_powershell_base64_invoke.yml","techniques":["T1059.001","T1027"],"cves":[]},{"id":"63e3365d-4824-42d8-8b82-e56810fefa0c","title":"Invoke-Obfuscation Via Use Clip - System","author":"Nikita Nazarov, oscd.community","status":"test","level":"high","date":"2020-10-09","modified":"2022-11-29","description":"Detects Obfuscated Powershell via use Clip.exe in Scripts","references":["https://github.com/SigmaHQ/sigma/issues/1009"],"logsource":{"product":"windows","service":"system"},"tags":["attack.stealth","attack.t1027","attack.execution","attack.t1059.001"],"path":"rules/windows/builtin/system/service_control_manager/win_system_invoke_obfuscation_via_use_clip_services.yml","techniques":["T1027","T1059.001"],"cves":[]},{"id":"641a4bfb-c017-44f7-800c-2aee0184ce9b","title":"Invoke-Obfuscation Via Use Rundll32 - System","author":"Nikita Nazarov, oscd.community","status":"test","level":"high","date":"2020-10-09","modified":"2022-11-29","description":"Detects Obfuscated Powershell via use Rundll32 in Scripts","references":["https://github.com/SigmaHQ/sigma/issues/1009"],"logsource":{"product":"windows","service":"system"},"tags":["attack.stealth","attack.t1027","attack.execution","attack.t1059.001"],"path":"rules/windows/builtin/system/service_control_manager/win_system_invoke_obfuscation_via_use_rundll32_services.yml","techniques":["T1027","T1059.001"],"cves":[]},{"id":"6bfb8fa7-b2e7-4f6c-8d9d-824e5d06ea9e","title":"Invoke-Obfuscation VAR+ Launcher - PowerShell Module","author":"Jonathan Cheong, oscd.community","status":"test","level":"high","date":"2020-10-15","modified":"2024-04-05","description":"Detects Obfuscated use of Environment Variables to execute PowerShell","references":["https://github.com/SigmaHQ/sigma/issues/1009"],"logsource":{"product":"windows","category":"ps_module"},"tags":["attack.stealth","attack.t1027","attack.execution","attack.t1059.001"],"path":"rules/windows/powershell/powershell_module/posh_pm_invoke_obfuscation_var.yml","techniques":["T1027","T1059.001"],"cves":[]},{"id":"6c96fc76-0eb1-11eb-adc1-0242ac120002","title":"Invoke-Obfuscation STDIN+ Launcher","author":"Jonathan Cheong, oscd.community","status":"test","level":"high","date":"2020-10-15","modified":"2024-04-15","description":"Detects Obfuscated use of stdin to execute PowerShell","references":["https://github.com/SigmaHQ/sigma/issues/1009"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.stealth","attack.t1027","attack.execution","attack.t1059.001"],"path":"rules/windows/process_creation/proc_creation_win_hktl_invoke_obfuscation_stdin.yml","techniques":["T1027","T1059.001"],"cves":[]},{"id":"7034cbbb-cc55-4dc2-8dad-36c0b942e8f1","title":"Invoke-Obfuscation COMPRESS OBFUSCATION - PowerShell Module","author":"Timur Zinniatullin, oscd.community","status":"test","level":"medium","date":"2020-10-18","modified":"2022-11-29","description":"Detects Obfuscated Powershell via COMPRESS OBFUSCATION","references":["https://github.com/SigmaHQ/sigma/issues/1009"],"logsource":{"product":"windows","category":"ps_module"},"tags":["attack.stealth","attack.t1027","attack.execution","attack.t1059.001"],"path":"rules/windows/powershell/powershell_module/posh_pm_invoke_obfuscation_via_compress.yml","techniques":["T1027","T1059.001"],"cves":[]},{"id":"719c22d7-c11a-4f2c-93a6-2cfdd5412f68","title":"Decode Base64 Encoded Text -MacOs","author":"Daniil Yugoslavskiy, oscd.community","status":"test","level":"low","date":"2020-10-19","modified":"2022-11-26","description":"Detects usage of base64 utility to decode arbitrary base64-encoded text","references":["https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1027/T1027.md"],"logsource":{"product":"macos","category":"process_creation"},"tags":["attack.stealth","attack.t1027"],"path":"rules/macos/process_creation/proc_creation_macos_base64_decode.yml","techniques":["T1027"],"cves":[]},{"id":"72862bf2-0eb1-11eb-adc1-0242ac120002","title":"Invoke-Obfuscation STDIN+ Launcher - System","author":"Jonathan Cheong, oscd.community","status":"test","level":"high","date":"2020-10-15","modified":"2022-11-29","description":"Detects Obfuscated use of stdin to execute PowerShell","references":["https://github.com/SigmaHQ/sigma/issues/1009"],"logsource":{"product":"windows","service":"system"},"tags":["attack.stealth","attack.t1027","attack.execution","attack.t1059.001"],"path":"rules/windows/builtin/system/service_control_manager/win_system_invoke_obfuscation_stdin_services.yml","techniques":["T1027","T1059.001"],"cves":[]},{"id":"73e67340-0d25-11eb-adc1-0242ac120002","title":"Invoke-Obfuscation CLIP+ Launcher - PowerShell","author":"Jonathan Cheong, oscd.community","status":"test","level":"high","date":"2020-10-13","modified":"2024-04-05","description":"Detects Obfuscated use of Clip.exe to execute PowerShell","references":["https://github.com/SigmaHQ/sigma/issues/1009"],"logsource":{"product":"windows","category":"ps_script"},"tags":["attack.stealth","attack.t1027","attack.execution","attack.t1059.001"],"path":"rules/windows/powershell/powershell_script/posh_ps_invoke_obfuscation_clip.yml","techniques":["T1027","T1059.001"],"cves":[]},{"id":"74403157-20f5-415d-89a7-c505779585cf","title":"ConvertTo-SecureString Cmdlet Usage Via CommandLine","author":"Teymur Kheirkhabarov (idea), Vasiliy Burov (rule), oscd.community, Tim Shelton","status":"test","level":"medium","date":"2020-10-11","modified":"2023-02-01","description":"Detects usage of the \"ConvertTo-SecureString\" cmdlet via the commandline. Which is fairly uncommon and could indicate potential suspicious activity","references":["https://speakerdeck.com/heirhabarov/hunting-for-powershell-abuse?slide=65","https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.security/convertto-securestring?view=powershell-7.3#examples"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.stealth","attack.t1027","attack.execution","attack.t1059.001"],"path":"rules/windows/process_creation/proc_creation_win_powershell_cmdline_convertto_securestring.yml","techniques":["T1027","T1059.001"],"cves":[]},{"id":"74ad4314-482e-4c3e-b237-3f7ed3b9ca8d","title":"Operation Wocao Activity - Security","author":"Florian Roth (Nextron Systems), frack113","status":"test","level":"high","date":"2019-12-20","modified":"2022-11-27","description":"Detects activity mentioned in Operation Wocao report","references":["https://web.archive.org/web/20200226212615/https://www.fox-it.com/en/news/whitepapers/operation-wocao-shining-a-light-on-one-of-chinas-hidden-hacking-groups/","https://web.archive.org/web/20200226212615/https://resources.fox-it.com/rs/170-CAK-271/images/201912_Report_Operation_Wocao.pdf","https://twitter.com/SBousseaden/status/1207671369963646976"],"logsource":{"product":"windows","service":"security"},"tags":["attack.privilege-escalation","attack.persistence","attack.discovery","attack.stealth","attack.t1012","attack.t1036.004","attack.t1027","attack.execution","attack.t1053.005","attack.t1059.001","detection.emerging-threats"],"path":"rules-emerging-threats/2019/TA/Operation-Wocao/win_security_apt_wocao.yml","techniques":["T1012","T1036.004","T1027","T1053.005","T1059.001"],"cves":[]},{"id":"779c8c12-0eb1-11eb-adc1-0242ac120002","title":"Invoke-Obfuscation STDIN+ Launcher - Powershell","author":"Jonathan Cheong, oscd.community","status":"test","level":"high","date":"2020-10-15","modified":"2024-04-05","description":"Detects Obfuscated use of stdin to execute PowerShell","references":["https://github.com/SigmaHQ/sigma/issues/1009"],"logsource":{"product":"windows","category":"ps_script"},"tags":["attack.stealth","attack.t1027","attack.execution","attack.t1059.001"],"path":"rules/windows/powershell/powershell_script/posh_ps_invoke_obfuscation_stdin.yml","techniques":["T1027","T1059.001"],"cves":[]},{"id":"7a922f1b-2635-4d6c-91ef-af228b198ad3","title":"Invoke-Obfuscation COMPRESS OBFUSCATION - Security","author":"Timur Zinniatullin, oscd.community","status":"test","level":"medium","date":"2020-10-18","modified":"2022-11-29","description":"Detects Obfuscated Powershell via COMPRESS OBFUSCATION","references":["https://github.com/SigmaHQ/sigma/issues/1009"],"logsource":{"product":"windows","service":"security"},"tags":["attack.stealth","attack.t1027","attack.execution","attack.t1059.001"],"path":"rules/windows/builtin/security/win_security_invoke_obfuscation_via_compress_services_security.yml","techniques":["T1027","T1059.001"],"cves":[]},{"id":"7e9c7999-0f9b-4d4a-a6ed-af6d553d4af4","title":"Invoke-Obfuscation Via Use MSHTA - System","author":"Nikita Nazarov, oscd.community","status":"test","level":"high","date":"2020-10-09","modified":"2022-11-29","description":"Detects Obfuscated Powershell via use MSHTA in Scripts","references":["https://github.com/SigmaHQ/sigma/issues/1009"],"logsource":{"product":"windows","service":"system"},"tags":["attack.stealth","attack.t1027","attack.execution","attack.t1059.001"],"path":"rules/windows/builtin/system/service_control_manager/win_system_invoke_obfuscation_via_use_mshta_services.yml","techniques":["T1027","T1059.001"],"cves":[]},{"id":"7eedcc9d-9fdb-4d94-9c54-474e8affc0c7","title":"Invoke-Obfuscation COMPRESS OBFUSCATION","author":"Timur Zinniatullin, oscd.community","status":"test","level":"medium","date":"2020-10-18","modified":"2022-12-29","description":"Detects Obfuscated Powershell via COMPRESS OBFUSCATION","references":["https://github.com/SigmaHQ/sigma/issues/1009"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.stealth","attack.t1027","attack.execution","attack.t1059.001"],"path":"rules/windows/process_creation/proc_creation_win_hktl_invoke_obfuscation_via_compress.yml","techniques":["T1027","T1059.001"],"cves":[]},{"id":"80b708f3-d034-40e4-a6c8-d23b7a7db3d1","title":"Invoke-Obfuscation Via Stdin - Security","author":"Nikita Nazarov, oscd.community","status":"test","level":"high","date":"2020-10-12","modified":"2022-11-29","description":"Detects Obfuscated Powershell via Stdin in Scripts","references":["https://github.com/SigmaHQ/sigma/issues/1009"],"logsource":{"product":"windows","service":"security"},"tags":["attack.stealth","attack.t1027","attack.execution","attack.t1059.001"],"path":"rules/windows/builtin/security/win_security_invoke_obfuscation_via_stdin_services_security.yml","techniques":["T1027","T1059.001"],"cves":[]},{"id":"82a6714f-4899-4f16-9c1e-9a333544d4c3","title":"File In Suspicious Location Encoded To Base64 Via Certutil.EXE","author":"Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"high","date":"2023-05-15","modified":"2024-03-05","description":"Detects the execution of certutil with the \"encode\" flag to encode a file to base64 where the files are located in potentially suspicious locations","references":["https://www.virustotal.com/gui/file/35c22725a92d5cb1016b09421c0a6cdbfd860fd4778b3313669b057d4a131cb7/behavior","https://www.virustotal.com/gui/file/427616528b7dbc4a6057ac89eb174a3a90f7abcf3f34e5a359b7a910d82f7a72/behavior","https://www.virustotal.com/gui/file/34de4c8beded481a4084a1fd77855c3e977e8ac643e5c5842d0f15f7f9b9086f/behavior","https://www.virustotal.com/gui/file/4abe1395a09fda06d897a9c4eb247278c1b6cddda5d126ce5b3f4f499e3b8fa2/behavior"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.stealth","attack.t1027"],"path":"rules/windows/process_creation/proc_creation_win_certutil_encode_susp_location.yml","techniques":["T1027"],"cves":[]},{"id":"86b896ba-ffa1-4fea-83e3-ee28a4c915c7","title":"Invoke-Obfuscation Via Stdin - Powershell","author":"Nikita Nazarov, oscd.community","status":"test","level":"high","date":"2020-10-12","modified":"2024-04-05","description":"Detects Obfuscated Powershell via Stdin in Scripts","references":["https://github.com/SigmaHQ/sigma/issues/1009"],"logsource":{"product":"windows","category":"ps_script"},"tags":["attack.stealth","attack.t1027","attack.execution","attack.t1059.001"],"path":"rules/windows/powershell/powershell_script/posh_ps_invoke_obfuscation_via_stdin.yml","techniques":["T1027","T1059.001"],"cves":[]},{"id":"88a22f69-62f9-4b8a-aa00-6b0212f2f05a","title":"Invoke-Obfuscation Via Use Rundll32 - PowerShell Module","author":"Nikita Nazarov, oscd.community","status":"test","level":"high","date":"2019-10-08","modified":"2022-11-29","description":"Detects Obfuscated Powershell via use Rundll32 in Scripts","references":["https://github.com/SigmaHQ/sigma/issues/1009"],"logsource":{"product":"windows","category":"ps_module"},"tags":["attack.stealth","attack.t1027","attack.execution","attack.t1059.001"],"path":"rules/windows/powershell/powershell_module/posh_pm_invoke_obfuscation_via_use_rundll32.yml","techniques":["T1027","T1059.001"],"cves":[]},{"id":"8ca7004b-e620-4ecb-870e-86129b5b8e75","title":"Invoke-Obfuscation VAR+ Launcher - System","author":"Jonathan Cheong, oscd.community","status":"test","level":"high","date":"2020-10-15","modified":"2022-11-29","description":"Detects Obfuscated use of Environment Variables to execute PowerShell","references":["https://github.com/SigmaHQ/sigma/issues/1009"],"logsource":{"product":"windows","service":"system"},"tags":["attack.stealth","attack.t1027","attack.execution","attack.t1059.001"],"path":"rules/windows/builtin/system/service_control_manager/win_system_invoke_obfuscation_var_services.yml","techniques":["T1027","T1059.001"],"cves":[]},{"id":"90b63c33-2b97-4631-a011-ceb0f47b77c3","title":"Potential Suspicious Execution From GUID Like Folder Names","author":"Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"low","date":"2022-09-01","modified":"2023-03-02","description":"Detects potential suspicious execution of a GUID like folder name located in a suspicious location such as %TEMP% as seen being used in IcedID attacks.\nUse this rule to hunt for potentially suspicious activity stemming from uncommon folders.\n","references":["https://twitter.com/Kostastsale/status/1565257924204986369"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.stealth","attack.t1027","detection.threat-hunting"],"path":"rules-threat-hunting/windows/process_creation/proc_creation_win_susp_execution_from_guid_folder_names.yml","techniques":["T1027"],"cves":[]},{"id":"96cd126d-f970-49c4-848a-da3a09f55c55","title":"Potential PowerShell Obfuscation Using Alias Cmdlets","author":"frack113","status":"test","level":"low","date":"2023-01-08","modified":"2025-10-22","description":"Detects Set-Alias or New-Alias cmdlet usage. Which can be use as a mean to obfuscate PowerShell scripts","references":["https://github.com/1337Rin/Swag-PSO"],"logsource":{"product":"windows","category":"ps_script"},"tags":["attack.execution","attack.stealth","attack.t1027","attack.t1059.001"],"path":"rules/windows/powershell/powershell_script/posh_ps_susp_set_alias.yml","techniques":["T1027","T1059.001"],"cves":[]},{"id":"9ac8b09b-45de-4a07-9da1-0de8c09304a3","title":"Invoke-Obfuscation STDIN+ Launcher - PowerShell Module","author":"Jonathan Cheong, oscd.community","status":"test","level":"high","date":"2020-10-15","modified":"2024-04-05","description":"Detects Obfuscated use of stdin to execute PowerShell","references":["https://github.com/SigmaHQ/sigma/issues/1009"],"logsource":{"product":"windows","category":"ps_module"},"tags":["attack.stealth","attack.t1027","attack.execution","attack.t1059.001"],"path":"rules/windows/powershell/powershell_module/posh_pm_invoke_obfuscation_stdin.yml","techniques":["T1027","T1059.001"],"cves":[]},{"id":"9b8d9203-4e0f-4cd9-bb06-4cc4ea6d0e9a","title":"Invoke-Obfuscation Via Use MSHTA - Security","author":"Nikita Nazarov, oscd.community","status":"test","level":"high","date":"2020-10-09","modified":"2022-11-29","description":"Detects Obfuscated Powershell via use MSHTA in Scripts","references":["https://github.com/SigmaHQ/sigma/issues/1009"],"logsource":{"product":"windows","service":"security"},"tags":["attack.stealth","attack.t1027","attack.execution","attack.t1059.001"],"path":"rules/windows/builtin/security/win_security_invoke_obfuscation_via_use_mshta_services_security.yml","techniques":["T1027","T1059.001"],"cves":[]},{"id":"9c0295ce-d60d-40bd-bd74-84673b7592b1","title":"Suspicious Encoded And Obfuscated Reflection Assembly Load Function Call","author":"pH-T (Nextron Systems)","status":"test","level":"high","date":"2022-03-01","modified":"2023-04-06","description":"Detects suspicious base64 encoded and obfuscated \"LOAD\" keyword used in .NET \"reflection.assembly\"","references":["https://github.com/Neo23x0/Raccine/blob/20a569fa21625086433dcce8bb2765d0ea08dcb6/yara/mal_revil.yar","https://thedfirreport.com/2022/05/09/seo-poisoning-a-gootloader-story/","https://learn.microsoft.com/en-us/dotnet/api/system.appdomain.load?view=net-7.0"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.execution","attack.stealth","attack.t1059.001","attack.t1027"],"path":"rules/windows/process_creation/proc_creation_win_powershell_base64_reflection_assembly_load_obfusc.yml","techniques":["T1059.001","T1027"],"cves":[]},{"id":"9c14c9fa-1a63-4a64-8e57-d19280559490","title":"Invoke-Obfuscation Via Stdin","author":"Nikita Nazarov, oscd.community","status":"test","level":"high","date":"2020-10-12","modified":"2026-03-16","description":"Detects Obfuscated Powershell via Stdin in Scripts","references":["https://github.com/SigmaHQ/sigma/issues/1009"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.stealth","attack.t1027","attack.execution","attack.t1059.001"],"path":"rules/windows/process_creation/proc_creation_win_hktl_invoke_obfuscation_via_stdin.yml","techniques":["T1027","T1059.001"],"cves":[]},{"id":"9e2e51c5-c699-4794-ba5a-29f5da40ac0c","title":"Turla Group Commands May 2020","author":"Florian Roth (Nextron Systems)","status":"test","level":"critical","date":"2020-05-26","modified":"2025-10-19","description":"Detects commands used by Turla group as reported by ESET in May 2020","references":["https://www.welivesecurity.com/wp-content/uploads/2020/05/ESET_Turla_ComRAT.pdf"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.privilege-escalation","attack.persistence","attack.stealth","attack.g0010","attack.execution","attack.t1059.001","attack.t1053.005","attack.t1027","detection.emerging-threats"],"path":"rules-emerging-threats/2014/TA/Turla/proc_creation_win_apt_turla_comrat_may20.yml","techniques":["T1059.001","T1053.005","T1027"],"cves":[]},{"id":"a136cde0-61ad-4a61-9b82-8dc490e60dd2","title":"Invoke-Obfuscation CLIP+ Launcher - PowerShell Module","author":"Jonathan Cheong, oscd.community","status":"test","level":"high","date":"2020-10-13","modified":"2024-04-05","description":"Detects Obfuscated use of Clip.exe to execute PowerShell","references":["https://github.com/SigmaHQ/sigma/issues/1009"],"logsource":{"product":"windows","category":"ps_module"},"tags":["attack.stealth","attack.t1027","attack.execution","attack.t1059.001"],"path":"rules/windows/powershell/powershell_module/posh_pm_invoke_obfuscation_clip.yml","techniques":["T1027","T1059.001"],"cves":[]},{"id":"a23791fe-8846-485a-b16b-ca691e1b03d4","title":"Invoke-Obfuscation RUNDLL LAUNCHER - PowerShell Module","author":"Timur Zinniatullin, oscd.community","status":"test","level":"medium","date":"2020-10-18","modified":"2022-11-29","description":"Detects Obfuscated Powershell via RUNDLL LAUNCHER","references":["https://github.com/SigmaHQ/sigma/issues/1009"],"logsource":{"product":"windows","category":"ps_module"},"tags":["attack.stealth","attack.t1027","attack.execution","attack.t1059.001"],"path":"rules/windows/powershell/powershell_module/posh_pm_invoke_obfuscation_via_rundll.yml","techniques":["T1027","T1059.001"],"cves":[]},{"id":"a5a30a6e-75ca-4233-8b8c-42e0f2037d3b","title":"Invoke-Obfuscation Via Use Rundll32 - PowerShell","author":"Nikita Nazarov, oscd.community","status":"test","level":"high","date":"2019-10-08","modified":"2022-11-29","description":"Detects Obfuscated Powershell via use Rundll32 in Scripts","references":["https://github.com/SigmaHQ/sigma/issues/1009"],"logsource":{"product":"windows","category":"ps_script"},"tags":["attack.stealth","attack.t1027","attack.execution","attack.t1059.001"],"path":"rules/windows/powershell/powershell_script/posh_ps_invoke_obfuscation_via_use_rundll32.yml","techniques":["T1027","T1059.001"],"cves":[]},{"id":"ac20ae82-8758-4f38-958e-b44a3140ca88","title":"Invoke-Obfuscation Via Use MSHTA","author":"Nikita Nazarov, oscd.community","status":"test","level":"high","date":"2020-10-08","modified":"2022-03-08","description":"Detects Obfuscated Powershell via use MSHTA in Scripts","references":["https://github.com/SigmaHQ/sigma/issues/1009"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.stealth","attack.t1027","attack.execution","attack.t1059.001"],"path":"rules/windows/process_creation/proc_creation_win_hktl_invoke_obfuscation_via_use_mhsta.yml","techniques":["T1027","T1059.001"],"cves":[]},{"id":"b222df08-0e07-11eb-adc1-0242ac120002","title":"Invoke-Obfuscation CLIP+ Launcher","author":"Jonathan Cheong, oscd.community","status":"test","level":"high","date":"2020-10-13","modified":"2022-11-17","description":"Detects Obfuscated use of Clip.exe to execute PowerShell","references":["https://github.com/SigmaHQ/sigma/issues/1009"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.stealth","attack.t1027","attack.execution","attack.t1059.001"],"path":"rules/windows/process_creation/proc_creation_win_hktl_invoke_obfuscation_clip.yml","techniques":["T1027","T1059.001"],"cves":[]},{"id":"b6b49cd1-34d6-4ead-b1bf-176e9edba9a4","title":"Potential PowerShell Obfuscation Via Reversed Commands","author":"Teymur Kheirkhabarov (idea), Vasiliy Burov (rule), oscd.community, Tim Shelton","status":"test","level":"high","date":"2020-10-11","modified":"2023-05-31","description":"Detects the presence of reversed PowerShell commands in the CommandLine. This is often used as a method of obfuscation by attackers","references":["https://2019.offzone.moscow/ru/report/hunting-for-powershell-abuses/","https://speakerdeck.com/heirhabarov/hunting-for-powershell-abuse?slide=66"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.stealth","attack.t1027","attack.execution","attack.t1059.001"],"path":"rules/windows/process_creation/proc_creation_win_powershell_cmdline_reversed_strings.yml","techniques":["T1027","T1059.001"],"cves":[]},{"id":"bb780e0c-16cf-4383-8383-1e5471db6cf9","title":"Suspicious XOR Encoded PowerShell Command","author":"Sami Ruohonen, Harish Segar, Tim Shelton, Teymur Kheirkhabarov, Vasiliy Burov, oscd.community, Nasreddine Bencherchali","status":"test","level":"medium","date":"2018-09-05","modified":"2023-01-30","description":"Detects presence of a potentially xor encoded powershell command","references":["https://speakerdeck.com/heirhabarov/hunting-for-powershell-abuse?slide=65","https://redcanary.com/blog/yellow-cockatoo/","https://zero2auto.com/2020/05/19/netwalker-re/","https://mez0.cc/posts/cobaltstrike-powershell-exec/"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.execution","attack.stealth","attack.t1059.001","attack.t1140","attack.t1027"],"path":"rules/windows/process_creation/proc_creation_win_powershell_xor_commandline.yml","techniques":["T1059.001","T1140","T1027"],"cves":[]},{"id":"c72aca44-8d52-45ad-8f81-f96c4d3c755e","title":"Invoke-Obfuscation Via Stdin - PowerShell Module","author":"Nikita Nazarov, oscd.community","status":"test","level":"high","date":"2020-10-12","modified":"2024-04-05","description":"Detects Obfuscated Powershell via Stdin in Scripts","references":["https://github.com/SigmaHQ/sigma/issues/1009"],"logsource":{"product":"windows","category":"ps_module"},"tags":["attack.stealth","attack.t1027","attack.execution","attack.t1059.001"],"path":"rules/windows/powershell/powershell_module/posh_pm_invoke_obfuscation_via_stdin.yml","techniques":["T1027","T1059.001"],"cves":[]},{"id":"cc9cbe82-7bc0-4ef5-bc23-bbfb83947be7","title":"File Decoded From Base64/Hex Via Certutil.EXE","author":"Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community","status":"test","level":"high","date":"2023-02-15","modified":"2025-06-04","description":"Detects the execution of certutil with either the \"decode\" or \"decodehex\" flags to decode base64 or hex encoded files. This can be abused by attackers to decode an encoded payload before execution","references":["https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/certutil","https://unit42.paloaltonetworks.com/new-babyshark-malware-targets-u-s-national-security-think-tanks/","https://news.sophos.com/en-us/2021/04/13/compromised-exchange-server-hosting-cryptojacker-targeting-other-exchange-servers/","https://twitter.com/JohnLaTwC/status/835149808817991680","https://learn.microsoft.com/en-us/archive/blogs/pki/basic-crl-checking-with-certutil","https://lolbas-project.github.io/lolbas/Binaries/Certutil/"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.stealth","attack.t1027"],"path":"rules/windows/process_creation/proc_creation_win_certutil_decode.yml","techniques":["T1027"],"cves":[]},{"id":"cd0f7229-d16f-42de-8fe3-fba365fbcb3a","title":"Invoke-Obfuscation Via Use Rundll32 - Security","author":"Nikita Nazarov, oscd.community","status":"test","level":"high","date":"2020-10-09","modified":"2022-11-29","description":"Detects Obfuscated Powershell via use Rundll32 in Scripts","references":["https://github.com/SigmaHQ/sigma/issues/1009"],"logsource":{"product":"windows","service":"security"},"tags":["attack.stealth","attack.t1027","attack.execution","attack.t1059.001"],"path":"rules/windows/builtin/security/win_security_invoke_obfuscation_via_use_rundll32_services_security.yml","techniques":["T1027","T1059.001"],"cves":[]},{"id":"cdf05894-89e7-4ead-b2b0-0a5f97a90f2f","title":"Potential Encoded PowerShell Patterns In CommandLine","author":"Teymur Kheirkhabarov (idea), Vasiliy Burov (rule), oscd.community, Tim Shelton","status":"test","level":"low","date":"2020-10-11","modified":"2023-01-26","description":"Detects specific combinations of encoding methods in PowerShell via the commandline","references":["https://speakerdeck.com/heirhabarov/hunting-for-powershell-abuse?slide=65"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.stealth","attack.t1027","attack.execution","attack.t1059.001"],"path":"rules/windows/process_creation/proc_creation_win_powershell_encoding_patterns.yml","techniques":["T1027","T1059.001"],"cves":[]},{"id":"d02e8cf5-6099-48cf-9bfc-1eec2d0c7b18","title":"Potential Emotet Activity","author":"Florian Roth (Nextron Systems)","status":"stable","level":"high","date":"2019-09-30","modified":"2023-02-04","description":"Detects all Emotet like process executions that are not covered by the more generic rules","references":["https://app.any.run/tasks/e13ab713-64cf-4b23-ad93-6dceaa5429ac/","https://app.any.run/tasks/81f3c28c-c686-425d-8a2b-a98198d244e1/","https://app.any.run/tasks/97f875e8-0e08-4328-815f-055e971ba754/","https://app.any.run/tasks/84fc9b4a-ea2b-47b1-8aa6-9014402dfb56/"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.execution","attack.stealth","attack.t1059.001","attack.t1027","detection.emerging-threats"],"path":"rules-emerging-threats/2019/Malware/Emotet/proc_creation_win_malware_emotet.yml","techniques":["T1059.001","T1027"],"cves":[]},{"id":"d7bcd677-645d-4691-a8d4-7a5602b780d1","title":"Potential PowerShell Command Line Obfuscation","author":"Teymur Kheirkhabarov (idea), Vasiliy Burov (rule), oscd.community, Tim Shelton (fp)","status":"test","level":"high","date":"2020-10-15","modified":"2024-04-15","description":"Detects the PowerShell command lines with special characters","references":["https://speakerdeck.com/heirhabarov/hunting-for-powershell-abuse?slide=64"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.execution","attack.stealth","attack.t1027","attack.t1059.001"],"path":"rules/windows/process_creation/proc_creation_win_powershell_cmdline_special_characters.yml","techniques":["T1027","T1059.001"],"cves":[]},{"id":"db92dd33-a3ad-49cf-8c2c-608c3e30ace0","title":"Invoke-Obfuscation Via Use Clip - Powershell","author":"Nikita Nazarov, oscd.community","status":"test","level":"high","date":"2020-10-09","modified":"2024-04-15","description":"Detects Obfuscated Powershell via use Clip.exe in Scripts","references":["https://github.com/SigmaHQ/sigma/issues/1009"],"logsource":{"product":"windows","category":"ps_script"},"tags":["attack.stealth","attack.t1027","attack.execution","attack.t1059.001"],"path":"rules/windows/powershell/powershell_script/posh_ps_invoke_obfuscation_via_use_clip.yml","techniques":["T1027","T1059.001"],"cves":[]},{"id":"dcf2db1f-f091-425b-a821-c05875b8925a","title":"Invoke-Obfuscation VAR+ Launcher - Security","author":"Jonathan Cheong, oscd.community","status":"test","level":"high","date":"2020-10-15","modified":"2022-11-29","description":"Detects Obfuscated use of Environment Variables to execute PowerShell","references":["https://github.com/SigmaHQ/sigma/issues/1009"],"logsource":{"product":"windows","service":"security"},"tags":["attack.stealth","attack.t1027","attack.execution","attack.t1059.001"],"path":"rules/windows/builtin/security/win_security_invoke_obfuscation_var_services_security.yml","techniques":["T1027","T1059.001"],"cves":[]},{"id":"e0552b19-5a83-4222-b141-b36184bb8d79","title":"Potential CommandLine Obfuscation Using Unicode Characters","author":"frack113, Florian Roth (Nextron Systems)","status":"test","level":"medium","date":"2022-01-15","modified":"2024-09-05","description":"Detects potential CommandLine obfuscation using unicode characters.\nAdversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit.\n","references":["https://www.wietzebeukema.nl/blog/windows-command-line-obfuscation","https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1027/T1027.md#atomic-test-6---dlp-evasion-via-sensitive-data-in-vba-macro-over-http"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.stealth","attack.t1027","detection.threat-hunting"],"path":"rules-threat-hunting/windows/process_creation/proc_creation_win_susp_cli_obfuscation_unicode.yml","techniques":["T1027"],"cves":[]},{"id":"e1561947-b4e3-4a74-9bdd-83baed21bdb5","title":"Invoke-Obfuscation Via Use Clip","author":"Nikita Nazarov, oscd.community","status":"test","level":"high","date":"2020-10-09","modified":"2026-03-16","description":"Detects Obfuscated Powershell via use Clip.exe in Scripts","references":["https://github.com/SigmaHQ/sigma/issues/1009"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.stealth","attack.t1027","attack.execution","attack.t1059.001"],"path":"rules/windows/process_creation/proc_creation_win_hktl_invoke_obfuscation_via_use_clip.yml","techniques":["T1027","T1059.001"],"cves":[]},{"id":"e2072cab-8c9a-459b-b63c-40ae79e27031","title":"Decode Base64 Encoded Text","author":"Daniil Yugoslavskiy, oscd.community","status":"test","level":"low","date":"2020-10-19","modified":"2021-11-27","description":"Detects usage of base64 utility to decode arbitrary base64-encoded text","references":["https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1027/T1027.md"],"logsource":{"product":"linux","category":"process_creation"},"tags":["attack.stealth","attack.t1027"],"path":"rules/linux/process_creation/proc_creation_lnx_base64_decode.yml","techniques":["T1027"],"cves":[]},{"id":"e312efd0-35a1-407f-8439-b8d434b438a6","title":"Potential PowerShell Obfuscation Via WCHAR/CHAR","author":"Florian Roth (Nextron Systems)","status":"test","level":"high","date":"2020-07-09","modified":"2025-03-03","description":"Detects suspicious encoded character syntax often used for defense evasion","references":["https://twitter.com/0gtweet/status/1281103918693482496"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.execution","attack.stealth","attack.t1059.001","attack.t1027"],"path":"rules/windows/process_creation/proc_creation_win_powershell_obfuscation_via_utf8.yml","techniques":["T1059.001","T1027"],"cves":[]},{"id":"e32d4572-9826-4738-b651-95fa63747e8a","title":"Base64 Encoded PowerShell Command Detected","author":"Florian Roth (Nextron Systems)","status":"test","level":"high","date":"2020-01-29","modified":"2023-01-26","description":"Detects usage of the \"FromBase64String\" function in the commandline which is used to decode a base64 encoded string","references":["https://gist.github.com/Neo23x0/6af876ee72b51676c82a2db8d2cd3639"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.stealth","attack.t1027","attack.execution","attack.t1140","attack.t1059.001"],"path":"rules/windows/process_creation/proc_creation_win_powershell_frombase64string.yml","techniques":["T1027","T1140","T1059.001"],"cves":[]},{"id":"e54f5149-6ba3-49cf-b153-070d24679126","title":"Invoke-Obfuscation VAR++ LAUNCHER OBFUSCATION - PowerShell","author":"Timur Zinniatullin, oscd.community","status":"test","level":"high","date":"2020-10-13","modified":"2024-04-05","description":"Detects Obfuscated Powershell via VAR++ LAUNCHER","references":["https://github.com/SigmaHQ/sigma/issues/1009"],"logsource":{"product":"windows","category":"ps_script"},"tags":["attack.stealth","attack.t1027","attack.execution","attack.t1059.001"],"path":"rules/windows/powershell/powershell_script/posh_ps_invoke_obfuscation_via_var.yml","techniques":["T1027","T1059.001"],"cves":[]},{"id":"e55a5195-4724-480e-a77e-3ebe64bd3759","title":"Invoke-Obfuscation Via Use MSHTA - PowerShell","author":"Nikita Nazarov, oscd.community","status":"test","level":"high","date":"2020-10-08","modified":"2022-11-29","description":"Detects Obfuscated Powershell via use MSHTA in Scripts","references":["https://github.com/SigmaHQ/sigma/issues/1009"],"logsource":{"product":"windows","category":"ps_script"},"tags":["attack.stealth","attack.t1027","attack.execution","attack.t1059.001"],"path":"rules/windows/powershell/powershell_script/posh_ps_invoke_obfuscation_via_use_mhsta.yml","techniques":["T1027","T1059.001"],"cves":[]},{"id":"e62a9f0c-ca1e-46b2-85d5-a6da77f86d1a","title":"File Encoded To Base64 Via Certutil.EXE","author":"Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community, Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"medium","date":"2019-02-24","modified":"2024-03-05","description":"Detects the execution of certutil with the \"encode\" flag to encode a file to base64. This can be abused by threat actors and attackers for data exfiltration","references":["https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/certutil","https://unit42.paloaltonetworks.com/new-babyshark-malware-targets-u-s-national-security-think-tanks/","https://lolbas-project.github.io/lolbas/Binaries/Certutil/"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.stealth","attack.t1027"],"path":"rules/windows/process_creation/proc_creation_win_certutil_encode.yml","techniques":["T1027"],"cves":[]},{"id":"e6cb92b4-b470-4eb8-8a9d-d63e8583aae0","title":"Invoke-Obfuscation RUNDLL LAUNCHER - PowerShell","author":"Timur Zinniatullin, oscd.community","status":"test","level":"medium","date":"2020-10-18","modified":"2022-11-29","description":"Detects Obfuscated Powershell via RUNDLL LAUNCHER","references":["https://github.com/SigmaHQ/sigma/issues/1009"],"logsource":{"product":"windows","category":"ps_script"},"tags":["attack.stealth","attack.t1027","attack.execution","attack.t1059.001"],"path":"rules/windows/powershell/powershell_script/posh_ps_invoke_obfuscation_via_rundll.yml","techniques":["T1027","T1059.001"],"cves":[]},{"id":"e8314f79-564d-4f79-bc13-fbc0bf2660d8","title":"Potential PowerShell Obfuscation Using Character Join","author":"Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"low","date":"2023-01-09","modified":null,"description":"Detects specific techniques often seen used inside of PowerShell scripts to obfscuate Alias creation","references":["Internal Research"],"logsource":{"product":"windows","category":"ps_script"},"tags":["attack.execution","attack.stealth","attack.t1027","attack.t1059.001"],"path":"rules/windows/powershell/powershell_script/posh_ps_susp_alias_obfscuation.yml","techniques":["T1027","T1059.001"],"cves":[]},{"id":"e9f55347-2928-4c06-88e5-1a7f8169942e","title":"Invoke-Obfuscation VAR++ LAUNCHER OBFUSCATION","author":"Timur Zinniatullin, oscd.community","status":"test","level":"high","date":"2020-10-13","modified":"2022-11-16","description":"Detects Obfuscated Powershell via VAR++ LAUNCHER","references":["https://github.com/SigmaHQ/sigma/issues/1009"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.stealth","attack.t1027","attack.execution","attack.t1059.001"],"path":"rules/windows/process_creation/proc_creation_win_hktl_invoke_obfuscation_via_var.yml","techniques":["T1027","T1059.001"],"cves":[]},{"id":"ea0cdc3e-2239-4f26-a947-4e8f8224e464","title":"Suspicious File Encoded To Base64 Via Certutil.EXE","author":"Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"high","date":"2023-05-15","modified":"2024-03-05","description":"Detects the execution of certutil with the \"encode\" flag to encode a file to base64 where the extensions of the file is suspicious","references":["https://www.virustotal.com/gui/file/35c22725a92d5cb1016b09421c0a6cdbfd860fd4778b3313669b057d4a131cb7/behavior","https://www.virustotal.com/gui/file/427616528b7dbc4a6057ac89eb174a3a90f7abcf3f34e5a359b7a910d82f7a72/behavior","https://www.virustotal.com/gui/file/34de4c8beded481a4084a1fd77855c3e977e8ac643e5c5842d0f15f7f9b9086f/behavior","https://www.virustotal.com/gui/file/4abe1395a09fda06d897a9c4eb247278c1b6cddda5d126ce5b3f4f499e3b8fa2/behavior"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.stealth","attack.t1027"],"path":"rules/windows/process_creation/proc_creation_win_certutil_encode_susp_extensions.yml","techniques":["T1027"],"cves":[]},{"id":"ebdf49d8-b89c-46c9-8fdf-2c308406f6bd","title":"Invoke-Obfuscation Via Use Clip - PowerShell Module","author":"Nikita Nazarov, oscd.community","status":"test","level":"high","date":"2020-10-09","modified":"2024-04-05","description":"Detects Obfuscated Powershell via use Clip.exe in Scripts","references":["https://github.com/SigmaHQ/sigma/issues/1009"],"logsource":{"product":"windows","category":"ps_module"},"tags":["attack.stealth","attack.t1027","attack.execution","attack.t1059.001"],"path":"rules/windows/powershell/powershell_module/posh_pm_invoke_obfuscation_via_use_clip.yml","techniques":["T1027","T1059.001"],"cves":[]},{"id":"f241cf1b-3a6b-4e1a-b4f9-133c00dd95ca","title":"Invoke-Obfuscation RUNDLL LAUNCHER - Security","author":"Timur Zinniatullin, oscd.community","status":"test","level":"medium","date":"2020-10-18","modified":"2022-11-29","description":"Detects Obfuscated Powershell via RUNDLL LAUNCHER","references":["https://github.com/SigmaHQ/sigma/issues/1009"],"logsource":{"product":"windows","service":"security"},"tags":["attack.stealth","attack.t1027","attack.execution","attack.t1059.001"],"path":"rules/windows/builtin/security/win_security_invoke_obfuscation_via_rundll_services_security.yml","techniques":["T1027","T1059.001"],"cves":[]},{"id":"f3c89218-8c3d-4ba9-9974-f1d8e6a1b4a6","title":"Invoke-Obfuscation VAR++ LAUNCHER OBFUSCATION - PowerShell Module","author":"Timur Zinniatullin, oscd.community","status":"test","level":"high","date":"2020-10-13","modified":"2024-04-05","description":"Detects Obfuscated Powershell via VAR++ LAUNCHER","references":["https://github.com/SigmaHQ/sigma/issues/1009"],"logsource":{"product":"windows","category":"ps_module"},"tags":["attack.stealth","attack.t1027","attack.execution","attack.t1059.001"],"path":"rules/windows/powershell/powershell_module/posh_pm_invoke_obfuscation_via_var.yml","techniques":["T1027","T1059.001"],"cves":[]},{"id":"f4264e47-f522-4c38-a420-04525d5b880f","title":"Renamed AutoIt Execution","author":"Florian Roth (Nextron Systems)","status":"test","level":"high","date":"2023-06-04","modified":"2024-11-23","description":"Detects the execution of a renamed AutoIt2.exe or AutoIt3.exe.\nAutoIt is a scripting language and automation tool for Windows systems. While primarily used for legitimate automation tasks, it can be misused in cyber attacks.\nAttackers can leverage AutoIt to create and distribute malware, including keyloggers, spyware, and botnets. A renamed AutoIt executable is particularly suspicious.\n","references":["https://twitter.com/malmoeb/status/1665463817130725378?s=12&t=C0_T_re0wRP_NfKa27Xw9w","https://www.autoitscript.com/site/"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.stealth","attack.t1027"],"path":"rules/windows/process_creation/proc_creation_win_renamed_autoit.yml","techniques":["T1027"],"cves":[]},{"id":"f7385ee2-0e0c-11eb-adc1-0242ac120002","title":"Invoke-Obfuscation CLIP+ Launcher - System","author":"Jonathan Cheong, oscd.community","status":"test","level":"high","date":"2020-10-13","modified":"2023-02-20","description":"Detects Obfuscated use of Clip.exe to execute PowerShell","references":["https://github.com/SigmaHQ/sigma/issues/1009"],"logsource":{"product":"windows","service":"system"},"tags":["attack.stealth","attack.t1027","attack.execution","attack.t1059.001"],"path":"rules/windows/builtin/system/service_control_manager/win_system_invoke_obfuscation_clip_services.yml","techniques":["T1027","T1059.001"],"cves":[]},{"id":"fd0f5778-d3cb-4c9a-9695-66759d04702a","title":"Invoke-Obfuscation Obfuscated IEX Invocation - Security","author":"Daniel Bohannon (@Mandiant/@FireEye), oscd.community","status":"test","level":"high","date":"2019-11-08","modified":"2022-11-27","description":"Detects all variations of obfuscated powershell IEX invocation code generated by Invoke-Obfuscation framework from the code block linked in the references","references":["https://github.com/danielbohannon/Invoke-Obfuscation/blob/f20e7f843edd0a3a7716736e9eddfa423395dd26/Out-ObfuscatedStringCommand.ps1#L873-L888"],"logsource":{"product":"windows","service":"security"},"tags":["attack.stealth","attack.t1027"],"path":"rules/windows/builtin/security/win_security_invoke_obfuscation_obfuscated_iex_services_security.yml","techniques":["T1027"],"cves":[]}],"kev_cves":[{"cveID":"CVE-2010-2883","state":"mapped","mapping_types":["primary_impact"]},{"cveID":"CVE-2022-24086","state":"mapped","mapping_types":["primary_impact"]},{"cveID":"CVE-2021-44077","state":"mapped","mapping_types":["secondary_impact"]},{"cveID":"CVE-2021-40449","state":"mapped","mapping_types":["secondary_impact"]},{"cveID":"CVE-2021-40539","state":"mapped","mapping_types":["secondary_impact"]}],"_built":"2026-08-23 05:47 UTC","_attack_version":"19.2","_sigma_commit":"da9bb07d642a2826e89702445d32c795209ec108"}