{"id":"T1140","name":"Deobfuscate/Decode Files or Information","url":"https://attack.mitre.org/techniques/T1140","tactics":["stealth"],"platforms":["ESXi","Linux","macOS","Windows"],"live":true,"revoked":false,"deprecated":false,"revoked_by":null,"detection_strategies":[{"id":"DET0275","stix_id":"x-mitre-detection-strategy--5b3bf2de-d91e-4272-97a8-5df6f4071e45","name":"Detect Adversary Deobfuscation or Decoding of Files and Payloads","url":"https://attack.mitre.org/detectionstrategies/DET0275","analytics":[{"id":"AN0767","stix_id":"x-mitre-analytic--75f05a04-103c-432a-afd6-8a8987b4370e","name":"Analytic 0767","description":"An adversary leverages built-in tools such as certutil.exe, powershell.exe, or copy.exe to decode, reassemble, or extract hidden malicious content from obfuscated containers or encoded formats. The decoding utility often spawns shortly after file staging or download and may be chained with script interpreters or further payload execution.","url":"https://attack.mitre.org/detectionstrategies/DET0275#AN0767","platforms":["Windows"],"log_source_references":[{"name":"WinEventLog:Sysmon","channel":"EventCode=1","data_component":"DC0032","data_component_name":"Process Creation","log_source_slug":"wineventlog-sysmon"},{"name":"WinEventLog:Sysmon","channel":"EventCode=11","data_component":"DC0039","data_component_name":"File Creation","log_source_slug":"wineventlog-sysmon"},{"name":"WinEventLog:Sysmon","channel":"EventCode=10","data_component":"DC0035","data_component_name":"Process Access","log_source_slug":"wineventlog-sysmon"}],"mutable_elements":[{"field":"ToolName","description":"May vary across environments (e.g., certutil, powershell, copy, expand, 7zip)"},{"field":"FileExtensionFilter","description":"Targets may use .txt, .cer, .enc, .b64, .zip, etc. to disguise payloads"},{"field":"CommandLineRegex","description":"Command syntax varies between base64 decoding, copy /b, and expand switches"},{"field":"TimeWindow","description":"Deobfuscation typically follows staging/download within a short timeframe"}],"live":true,"detection_strategies":["DET0275"],"techniques":["T1140"]},{"id":"AN0768","stix_id":"x-mitre-analytic--c4866ad5-310c-4a72-89b5-1e5a8683d286","name":"Analytic 0768","description":"The adversary uses native utilities like base64, gzip, tar, or openssl to decode, decompress, or decrypt files that were previously staged or downloaded. These tools may be chained with curl/wget and executed via bash/zsh, often to extract an embedded payload or reverse shell script.","url":"https://attack.mitre.org/detectionstrategies/DET0275#AN0768","platforms":["Linux"],"log_source_references":[{"name":"auditd:SYSCALL","channel":"bash/zsh of base64, tar, gzip, or openssl immediately after file write","data_component":"DC0064","data_component_name":"Command Execution","log_source_slug":"auditd-syscall"}],"mutable_elements":[{"field":"ShellProcessName","description":"Shell interpreter may vary (bash, zsh, dash, sh)"},{"field":"DecodeUtility","description":"May include base64, openssl, gunzip, tar, uudecode"},{"field":"ParentProcess","description":"Expected parent process may vary in attacker chain (e.g., curl, bash, ssh)"},{"field":"ArgumentPattern","description":"Detection regex should support flexible patterning of decode switches"}],"live":true,"detection_strategies":["DET0275"],"techniques":["T1140"]},{"id":"AN0769","stix_id":"x-mitre-analytic--0029e7e7-d42c-4a91-8d00-6bf6fd72962f","name":"Analytic 0769","description":"The adversary invokes built-in scripting or decoding tools like base64, plutil, or AppleScript-based utilities to decode files embedded in staging artifacts. Decoding often occurs post-download or as part of post-exploitation payload deployment via zsh, python, or osascript.","url":"https://attack.mitre.org/detectionstrategies/DET0275#AN0769","platforms":["macOS"],"log_source_references":[{"name":"macos:unifiedlog","channel":"base64 -d or osascript invoked on staged file","data_component":"DC0064","data_component_name":"Command Execution","log_source_slug":"macos-unifiedlog"}],"mutable_elements":[{"field":"DecodeInterpreter","description":"Could involve base64, osascript, python, perl, or plutil"},{"field":"ExecutionContext","description":"Deobfuscation may happen within GUI app context or LaunchAgent/Daemon"},{"field":"UserContext","description":"May differ depending on local user, root escalation, or persistence method"}],"live":true,"detection_strategies":["DET0275"],"techniques":["T1140"]}],"live":true,"version":"1.0","techniques":["T1140"]}],"sigma_rules":[{"id":"04b45a8a-d11d-49e4-9acc-4a1b524407a5","title":"DNS-over-HTTPS Enabled by Registry","author":"Austin Songer","status":"test","level":"medium","date":"2021-07-22","modified":"2023-08-17","description":"Detects when a user enables DNS-over-HTTPS.\nThis can be used to hide internet activity or be used to hide the process of exfiltrating data.\nWith this enabled organization will lose visibility into data such as query type, response and originating IP that are used to determine bad actors.\n","references":["https://www.tenforums.com/tutorials/151318-how-enable-disable-dns-over-https-doh-microsoft-edge.html","https://github.com/elastic/detection-rules/issues/1371","https://chromeenterprise.google/policies/?policy=DnsOverHttpsMode","https://admx.help/HKLM/Software/Policies/Mozilla/Firefox/DNSOverHTTPS"],"logsource":{"product":"windows","category":"registry_set"},"tags":["attack.persistence","attack.stealth","attack.defense-impairment","attack.t1140","attack.t1112"],"path":"rules/windows/registry/registry_set/registry_set_dns_over_https_enabled.yml","techniques":["T1140","T1112"],"cves":[]},{"id":"09a910bf-f71f-4737-9c40-88880ba5913d","title":"Potential Base64 Decoded From Images","author":"Joseliyo Sanchez, @Joseliyo_Jstnk","status":"test","level":"high","date":"2023-12-20","modified":null,"description":"Detects the use of tail to extract bytes at an offset from an image and then decode the base64 value to create a new file with the decoded content. The detected execution is a bash one-liner.\n","references":["https://www.virustotal.com/gui/file/16bafdf741e7a13137c489f3c8db1334f171c7cb13b62617d691b0a64783cc48/behavior","https://www.virustotal.com/gui/file/483fafc64a2b84197e1ef6a3f51e443f84dc5742602e08b9e8ec6ad690b34ed0/behavior"],"logsource":{"product":"macos","category":"process_creation"},"tags":["attack.stealth","attack.t1140"],"path":"rules/macos/process_creation/proc_creation_macos_tail_base64_decode_from_image.yml","techniques":["T1140"],"cves":[]},{"id":"1a0d4aba-7668-4365-9ce4-6d79ab088dfd","title":"Ping Hex IP","author":"Florian Roth (Nextron Systems)","status":"test","level":"high","date":"2018-03-23","modified":"2025-10-17","description":"Detects a ping command that uses a hex encoded IP address","references":["https://github.com/vysecurity/Aggressor-VYSEC/blob/0d61c80387b9432dab64b8b8a9fb52d20cfef80e/ping.cna","https://twitter.com/vysecurity/status/977198418354491392"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.stealth","attack.t1140","attack.t1027"],"path":"rules/windows/process_creation/proc_creation_win_ping_hex_ip.yml","techniques":["T1140","T1027"],"cves":[]},{"id":"1ddc1472-8e52-4f7d-9f11-eab14fc171f5","title":"PowerShell Decompress Commands","author":"Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research)","status":"test","level":"informational","date":"2020-05-02","modified":"2022-12-25","description":"A General detection for specific decompress commands in PowerShell logs. This could be an adversary decompressing files.","references":["https://github.com/OTRF/detection-hackathon-apt29/issues/8","https://github.com/OTRF/ThreatHunter-Playbook/blob/2d4257f630f4c9770f78d0c1df059f891ffc3fec/docs/evals/apt29/detections/4.A.3_09F29912-8E93-461E-9E89-3F06F6763383.md"],"logsource":{"product":"windows","category":"ps_module"},"tags":["attack.stealth","attack.t1140"],"path":"rules/windows/powershell/powershell_module/posh_pm_decompress_commands.yml","techniques":["T1140"],"cves":[]},{"id":"234dc5df-40b5-49d1-bf53-0d44ce778eca","title":"Payload Decoded and Decrypted via Built-in Utilities","author":"Tim Rauch (rule), Elastic (idea)","status":"test","level":"medium","date":"2022-10-17","modified":null,"description":"Detects when a built-in utility is used to decode and decrypt a payload after a macOS disk image (DMG) is executed. Malware authors may attempt to evade detection and trick users into executing malicious code by encoding and encrypting their payload and placing it in a disk image file. This behavior is consistent with adware or malware families such as Bundlore and Shlayer.","references":["https://github.com/elastic/protections-artifacts/commit/746086721fd385d9f5c6647cada1788db4aea95f#diff-5d42c3d772e04f1e8d0eb60f5233bc79def1ea73105a2d8822f44164f77ef823"],"logsource":{"product":"macos","category":"process_creation"},"tags":["attack.stealth","attack.t1059","attack.t1204","attack.execution","attack.t1140","attack.s0482","attack.s0402"],"path":"rules/macos/process_creation/proc_creation_macos_payload_decoded_and_decrypted.yml","techniques":["T1059","T1204","T1140"],"cves":[]},{"id":"23835beb-ec38-4e74-a5d4-b99af6684e91","title":"UNC4841 - Download Tar File From Untrusted Direct IP Via Wget","author":"Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"high","date":"2023-06-16","modified":null,"description":"Detects execution of \"wget\" to download a \"tar\" from an IP address that doesn't have a trusted certificate. As seen used by UNC4841 during their Barracuda ESG zero day exploitation.","references":["https://www.mandiant.com/resources/blog/barracuda-esg-exploited-globally"],"logsource":{"product":"linux","category":"process_creation"},"tags":["attack.stealth","attack.t1140","detection.emerging-threats"],"path":"rules-emerging-threats/2023/TA/UNC4841-Barracuda-ESG-Zero-Day-Exploitation/proc_creation_lnx_apt_unc4841_wget_download_tar_files_direct_ip.yml","techniques":["T1140"],"cves":[]},{"id":"60911c07-f989-4362-84af-c609828ef829","title":"UNC4841 - SSL Certificate Exfiltration Via Openssl","author":"Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"high","date":"2023-06-16","modified":null,"description":"Detects the execution of \"openssl\" to connect to an IP address. This techniques was used by UNC4841 to exfiltrate SSL certificates and as a C2 channel with named pipes. Investigate commands executed in the temporal vicinity of this command.","references":["https://www.mandiant.com/resources/blog/barracuda-esg-exploited-globally"],"logsource":{"product":"linux","category":"process_creation"},"tags":["attack.stealth","attack.t1140","detection.emerging-threats"],"path":"rules-emerging-threats/2023/TA/UNC4841-Barracuda-ESG-Zero-Day-Exploitation/proc_creation_lnx_apt_unc4841_openssl_connection.yml","techniques":["T1140"],"cves":[]},{"id":"60d050c4-e253-4d9a-b673-5ac100cfddfb","title":"UNC4841 - Download Compressed Files From Temp.sh Using Wget","author":"Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"high","date":"2023-06-16","modified":null,"description":"Detects execution of \"wget\" to download a \".zip\" or \".rar\" files from \"temp.sh\". As seen used by UNC4841 during their Barracuda ESG zero day exploitation.","references":["https://www.mandiant.com/resources/blog/barracuda-esg-exploited-globally"],"logsource":{"product":"linux","category":"process_creation"},"tags":["attack.stealth","attack.t1140","detection.emerging-threats"],"path":"rules-emerging-threats/2023/TA/UNC4841-Barracuda-ESG-Zero-Day-Exploitation/proc_creation_lnx_apt_unc4841_wget_download_compressed_file_tmep_sh.yml","techniques":["T1140"],"cves":[]},{"id":"880973f3-9708-491c-a77b-2a35a1921158","title":"Linux Shell Pipe to Shell","author":"Florian Roth (Nextron Systems)","status":"test","level":"medium","date":"2022-03-14","modified":"2022-07-26","description":"Detects suspicious process command line that starts with a shell that executes something and finally gets piped into another shell","references":["Internal Research"],"logsource":{"product":"linux","category":"process_creation"},"tags":["attack.stealth","attack.t1140"],"path":"rules/linux/process_creation/proc_creation_lnx_susp_pipe_shell.yml","techniques":["T1140"],"cves":[]},{"id":"999e8307-a775-4d5f-addc-4855632335be","title":"Potential BlackByte Ransomware Activity","author":"Florian Roth (Nextron Systems)","status":"test","level":"high","date":"2022-02-25","modified":"2023-02-08","description":"Detects command line patterns used by BlackByte ransomware in different operations","references":["https://redcanary.com/blog/blackbyte-ransomware/"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.execution","attack.impact","attack.stealth","attack.t1485","attack.t1498","attack.t1059.001","attack.t1140","detection.emerging-threats"],"path":"rules-emerging-threats/2021/Malware/BlackByte/proc_creation_win_malware_blackbyte_ransomware.yml","techniques":["T1485","T1498","T1059.001","T1140"],"cves":[]},{"id":"ba592c6d-6888-43c3-b8c6-689b8fe47337","title":"Linux Base64 Encoded Pipe to Shell","author":"pH-T (Nextron Systems)","status":"test","level":"medium","date":"2022-07-26","modified":"2023-06-16","description":"Detects suspicious process command line that uses base64 encoded input for execution with a shell","references":["https://github.com/arget13/DDexec","https://www.mandiant.com/resources/blog/barracuda-esg-exploited-globally"],"logsource":{"product":"linux","category":"process_creation"},"tags":["attack.stealth","attack.t1140"],"path":"rules/linux/process_creation/proc_creation_lnx_base64_execution.yml","techniques":["T1140"],"cves":[]},{"id":"bb780e0c-16cf-4383-8383-1e5471db6cf9","title":"Suspicious XOR Encoded PowerShell Command","author":"Sami Ruohonen, Harish Segar, Tim Shelton, Teymur Kheirkhabarov, Vasiliy Burov, oscd.community, Nasreddine Bencherchali","status":"test","level":"medium","date":"2018-09-05","modified":"2023-01-30","description":"Detects presence of a potentially xor encoded powershell command","references":["https://speakerdeck.com/heirhabarov/hunting-for-powershell-abuse?slide=65","https://redcanary.com/blog/yellow-cockatoo/","https://zero2auto.com/2020/05/19/netwalker-re/","https://mez0.cc/posts/cobaltstrike-powershell-exec/"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.execution","attack.stealth","attack.t1059.001","attack.t1140","attack.t1027"],"path":"rules/windows/process_creation/proc_creation_win_powershell_xor_commandline.yml","techniques":["T1059.001","T1140","T1027"],"cves":[]},{"id":"cc7abbd0-762b-41e3-8a26-57ad50d2eea3","title":"MSHTA Execution with Suspicious File Extensions","author":"Diego Perez (@darkquassar), Markus Neis, Swisscom (Improve Rule), Swachchhanda Shrawan Poudel (Nextron Systems)","status":"test","level":"high","date":"2019-02-22","modified":"2025-05-12","description":"Detects execution of mshta.exe with file types that looks like they do not typically represent HTA (HTML Application) content,\nsuch as .png, .jpg, .zip, .pdf, and others, which are often polyglots. MSHTA is a legitimate Windows utility for executing HTML Applications\ncontaining VBScript or JScript. Threat actors often abuse this lolbin utility to download and\nexecute malicious scripts disguised as benign files or hosted under misleading extensions to evade detection.\n","references":["http://blog.sevagas.com/?Hacking-around-HTA-files","https://0x00sec.org/t/clientside-exploitation-in-2018-how-pentesting-has-changed/7356","https://learn.microsoft.com/en-us/previous-versions/dotnet/framework/data/xml/xslt/xslt-stylesheet-scripting-using-msxsl-script","https://medium.com/tsscyber/pentesting-and-hta-bypassing-powershell-constrained-language-mode-53a42856c997","https://twitter.com/mattifestation/status/1326228491302563846","https://www.virustotal.com/gui/file/c1f27d9795a2eba630db8a043580a0761798f06370fb1317067805f8a845b00c"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.stealth","attack.t1140","attack.t1218.005","attack.execution","attack.t1059.007","cve.2020-1599"],"path":"rules/windows/process_creation/proc_creation_win_mshta_susp_execution.yml","techniques":["T1140","T1218.005","T1059.007"],"cves":["CVE-2020-1599"]},{"id":"ceb55fd0-726e-4656-bf4e-b585b7f7d572","title":"Suspicious Inbox Manipulation Rules","author":"Mark Morowczynski '@markmorow', Gloria Lee, '@gleeiamglo'","status":"test","level":"high","date":"2023-09-03","modified":null,"description":"Detects suspicious rules that delete or move messages or folders are set on a user's inbox.","references":["https://learn.microsoft.com/en-us/entra/id-protection/concept-identity-protection-risks#suspicious-inbox-manipulation-rules","https://learn.microsoft.com/en-us/entra/architecture/security-operations-user-accounts#unusual-sign-ins"],"logsource":{"product":"azure","service":"riskdetection"},"tags":["attack.stealth","attack.t1140"],"path":"rules/cloud/azure/identity_protection/azure_identity_protection_inbox_manipulation.yml","techniques":["T1140"],"cves":[]},{"id":"e32d4572-9826-4738-b651-95fa63747e8a","title":"Base64 Encoded PowerShell Command Detected","author":"Florian Roth (Nextron Systems)","status":"test","level":"high","date":"2020-01-29","modified":"2023-01-26","description":"Detects usage of the \"FromBase64String\" function in the commandline which is used to decode a base64 encoded string","references":["https://gist.github.com/Neo23x0/6af876ee72b51676c82a2db8d2cd3639"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.stealth","attack.t1027","attack.execution","attack.t1140","attack.t1059.001"],"path":"rules/windows/process_creation/proc_creation_win_powershell_frombase64string.yml","techniques":["T1027","T1140","T1059.001"],"cves":[]},{"id":"f0cdd048-82dc-4f7a-8a7a-b87a52b6d0fd","title":"Potential Commandline Obfuscation Using Escape Characters","author":"juju4","status":"test","level":"medium","date":"2018-12-11","modified":"2023-03-03","description":"Detects potential commandline obfuscation using known escape characters","references":["https://twitter.com/vysecurity/status/885545634958385153","https://twitter.com/Hexacorn/status/885553465417756673","https://twitter.com/Hexacorn/status/885570278637678592","https://www.mandiant.com/resources/blog/obfuscation-wild-targeted-attackers-lead-way-evasion-techniques","https://web.archive.org/web/20190213114956/http://www.windowsinspired.com/understanding-the-command-line-string-and-arguments-received-by-a-windows-program/"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.stealth","attack.t1140"],"path":"rules/windows/process_creation/proc_creation_win_susp_cli_obfuscation_escape_char.yml","techniques":["T1140"],"cves":[]},{"id":"fdb62a13-9a81-4e5c-a38f-ea93a16f6d7c","title":"PowerShell Base64 Encoded FromBase64String Cmdlet","author":"Florian Roth (Nextron Systems)","status":"test","level":"high","date":"2019-08-24","modified":"2023-04-06","description":"Detects usage of a base64 encoded \"FromBase64String\" cmdlet in a process command line","references":["Internal Research"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.stealth","attack.t1140","attack.execution","attack.t1059.001"],"path":"rules/windows/process_creation/proc_creation_win_powershell_base64_frombase64string.yml","techniques":["T1140","T1059.001"],"cves":[]},{"id":"fe2f9663-41cb-47e2-b954-8a228f3b9dff","title":"Linux Base64 Encoded Shebang In CLI","author":"Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"medium","date":"2022-09-15","modified":null,"description":"Detects the presence of a base64 version of the shebang in the commandline, which could indicate a malicious payload about to be decoded","references":["https://www.trendmicro.com/pl_pl/research/20/i/the-evolution-of-malicious-shell-scripts.html","https://github.com/carlospolop/PEASS-ng/tree/master/linPEAS"],"logsource":{"product":"linux","category":"process_creation"},"tags":["attack.stealth","attack.t1140"],"path":"rules/linux/process_creation/proc_creation_lnx_base64_shebang_cli.yml","techniques":["T1140"],"cves":[]}],"kev_cves":[{"cveID":"CVE-2021-44077","state":"mapped","mapping_types":["secondary_impact"]},{"cveID":"CVE-2021-40539","state":"mapped","mapping_types":["secondary_impact"]}],"_built":"2026-08-23 05:47 UTC","_attack_version":"19.2","_sigma_commit":"da9bb07d642a2826e89702445d32c795209ec108"}