Obfuscation is the most common way malware hides from signature scanning, because a trivially encoded payload looks different to every file scanner but identical to the interpreter that finally runs it. MITRE ATT&CK T1027 Obfuscated Files or Information covers encoding, encrypting, packing, splitting and otherwise disguising content so it is hard to discover or analyse. In ATT&CK v20 it sits in the Stealth tactic (TA0005), has 18 sub-techniques and is linked to more than 130 malware families. This guide explains the sub-technique families at the level of the ATT&CK descriptions, then concentrates on detection at the point of deobfuscation (AMSI and script logging), entropy and structure analysis, and the prevention settings that block obfuscated content. It is for detection engineers, SOC analysts and endpoint owners; it contains no obfuscation methods.
Key takeaways
- Catch it when it is decoded. Content must reach the interpreter as plain code, which is where AMSI and PowerShell script block logging see it, whatever the encoding layers on disk.
- Obfuscation itself is a signal. Benign administrative scripts rarely look like obfuscated ones, so anomalous command length, character mix, encoding flags and file entropy are useful detection features.
- 18 sub-techniques, four families. File transformation, delivery smuggling, code-level evasion and hiding in non-file storage each need different telemetry.
- Prevention exists for the commonest paths. The ASR rule "Block execution of potentially obfuscated scripts", script engine controls and mail and web filtering of smuggling formats cut most commodity use.
- Pair it with T1140. Every obfuscated payload must be decoded before it runs; ATT&CK tracks that as T1140 Deobfuscate/Decode Files or Information, a second chance to detect.
How the attack works
ATT&CK describes T1027 as making an executable or file difficult to discover or analyse "by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit". Payloads may be compressed, archived or encrypted, partly encoded to hide strings, or split into benign-looking pieces. The defender's view of the sub-techniques:
| Family | Sub-techniques (v20) | What defenders lose | Where it becomes visible |
|---|---|---|---|
| Transforming the file | .001 Binary Padding, .002 Software Packing, .008 Stripped Payloads, .013 Encrypted/Encoded File, .014 Polymorphic Code, .015 Compression, .016 Junk Code Insertion | Stable hashes and static signatures; file size limits on scanners | Entropy and structure, unpacking in memory, behaviour after execution |
| Smuggling past filters | .003 Steganography, .006 HTML Smuggling, .009 Embedded Payloads, .012 LNK Icon Smuggling, .017 SVG Smuggling | Gateway inspection of attachments and downloads | Browser writing files, archives or images with script, Mark-of-the-Web handling |
| Code-level evasion | .004 Compile After Delivery, .005 Indicator Removal from Tools, .007 Dynamic API Resolution, .010 Command Obfuscation, .018 Invisible Unicode | Readable strings, imports and command lines | Compiler starts on endpoints, AMSI and script logs, command-line features |
| Hiding outside files | .011 Fileless Storage | File scanning entirely | Registry, WMI repository and event log content; /dev/shm on Linux |
For hands-on decoding of suspicious samples in a lab, see the CyberChef for Analysts Guide; this page covers detection and prevention at scale.
Where it shows up
- Phishing delivery: HTML and SVG smuggling, encrypted archives and embedded payloads in documents. ATT&CK records APT29 embedding ISO files in HTML attachments. See the HTML Smuggling Guide and the Malicious LNK Files Guide.
- Script-based execution: encoded PowerShell, JavaScript and shell one-liners, often in combination with T1059 Command and Scripting Interpreter. ATT&CK records Salt Typhoon using double encoding of paths to bypass security tools.
- Tooling on compromised hosts: packed utilities and proxies; CISA's advisory AA24-038A describes Volt Typhoon packing its FRP client and a port scanner with UPX.
- Supply chain implants: ATT&CK records the 3CX supply chain attack using encrypted DLLs and embedded payloads in a chained loader.
- Fileless persistence: encoded content in registry values or WMI classes, retrieved at run time.
Impact
Obfuscation rarely causes harm directly; it lets every other stage run unseen. Signature-based controls miss the payload, sandboxes may never see decoded behaviour, and analysts spend hours decoding instead of scoping. Microsoft's AMSI documentation notes that a signature for a trivial obfuscator would also match benign scripts, producing too many false positives, which is why behaviour and decode-time inspection matter more than file hashes.
Detection
ATT&CK v20 maps DET0378 to the parent and one strategy to each sub-technique, for example DET0505 for command obfuscation, DET0023 for packing and DET0344 for fileless storage.
| Approach | Telemetry | How it helps |
|---|---|---|
| Decode-time inspection | AMSI providers (PowerShell, Windows script hosts, Office VBA) | Microsoft's AMSI documentation says content may pass through several de-obfuscation passes but must reach the engine as plain code, and that is where AMSI is called |
| Script content logging | PowerShell script block logging, event 4104 (Windows PowerShell and PowerShell 7 logs) | Records the content of every script block processed, after decoding, for hunting and retrospective search |
| Command-line features | Security 4688 with command line, Sysmon 1, auditd execve, macOS Endpoint Security exec events | DET0505 flags excessive escape characters, encoding flags, concatenation and outlier length or entropy |
| File entropy and structure | Sysmon 11 file creation, EDR file events, YARA scans | Packed and encrypted content sits close to the 8 bits per byte maximum; YARA's math module supports conditions such as entropy of the whole file of 7 or more |
| Unpacking behaviour | Sysmon 10, EDR memory events, auditd mprotect | DET0023 looks for memory allocated and made executable, then run from non-image regions |
| Fileless storage | Security 4657 registry value changes, WMI activity logs, auditd writes in /dev/shm | Large or high-entropy registry values and WMI classes, executable content in shared memory |
| Smuggling | Mail and web gateway logs, browser file creation, Sysmon 11 and 15 | HTML or SVG attachments that write archives, disk images or scripts to Downloads |
Tuning advice
- Baseline encoders: some management agents legitimately send encoded commands. Allowlist by signer, parent process and path, not by command text.
- Score, do not match: combine features (encoding flag, length outlier, rare parent, network connection soon after) into a risk score; single features are noisy.
- Retro-hunt: keep 4104 content long enough to search when new intelligence arrives. See the Sigma Rules Guide and the YARA Rules Guide.
Metrics
- Script logging coverage: share of Windows endpoints sending 4104 events centrally.
- AMSI health: share of endpoints with an active AMSI provider and current definitions.
- ASR obfuscated-script rule state: share of devices in Block mode, and audit events per week before enforcement.
- Command-line coverage: share of hosts sending process creation with full command lines.
- Analyst decode time: median minutes to decode a flagged sample, a measure of tooling maturity.
Prevention and hardening
- ASR rules (M1040): "Block execution of potentially obfuscated scripts" (GUID
5beb7efe-fd9a-4556-801d-275e5ffc04cc) depends on Microsoft Defender Antivirus, AMSI and cloud protection. "Block JavaScript or VBScript from launching downloaded executable content" (d3e037e1-3eb8-44c8-a917-57927947596d) and "Block Win32 API calls from Office macros" (92e97fa1-2edf-4476-bdd6-9dd0b4dddc7b) depend on AMSI. Microsoft advises Audit mode (value 2) first for these, review, then Block (1) or Warn (6). - Keep AMSI effective (M1049): use an antimalware product that registers as an AMSI provider, and alert on attempts to tamper with it, which is T1685 territory. See the T1685 Disable or Modify Tools Defensive Guide.
- Script logging with protection: enable script block logging by Group Policy and use Protected Event Logging so any secrets in logged scripts are encrypted to a certificate whose private key lives only on the collector. See the PowerShell Security Guide.
- Remove downgrade paths: remove PowerShell 2.0, which predates script block logging, so obfuscated scripts cannot fall back to an unlogged engine (T1689).
- Application control (M1038): block script hosts and compilers that ordinary users do not need, which defeats compile after delivery. See the Application Allowlisting Guide.
- Filter and isolate delivery (M1048 Application Isolation and Sandboxing, mapped to the smuggling sub-techniques): detonate or strip HTML, SVG and archive attachments at the mail gateway, and keep Mark-of-the-Web propagation for downloaded containers. See the Office Macro Blocking Guide.
- Audit fileless locations (M1047): periodically review registry and WMI repository content for abnormal data, as ATT&CK suggests.
Choosing controls
| Situation | First steps | Trade-off |
|---|---|---|
| Microsoft-centred estate | ASR rules in audit then block, script block logging, PowerShell 2.0 removed | Some admin scripts trigger the obfuscation rule; exclude by path and signer |
| Mixed or non-Microsoft EDR | Confirm the product's AMSI provider and script telemetry; add Sigma rules on command-line features | Feature parity varies; test with benign encoded samples |
| Linux and macOS heavy | auditd execve and Endpoint Security exec events with full arguments; restrict compilers on servers | No AMSI equivalent; rely on command and file features |
| Small team | Turn on the obfuscated-script ASR rule and gateway attachment filtering | Little hunting capacity, so prevention gives the best return |
Phased rollout
- Enable telemetry: script block logging, command-line process auditing and Sysmon file events on a pilot ring; size the volume.
- Audit ASR: run the rules above in Audit mode for two to four weeks and review the
Asr...Auditedevents in advanced hunting. - Exclude narrowly: add path or signer exclusions for verified line-of-business scripts only, with an owner and expiry.
- Enforce: move to Block by ring; rollback is setting the rule back to Audit.
- Hunt and test: add scoring analytics and validate them with authorised, benign encoded test content.
Lessons from incidents
- Packed tools still behave like tools: UPX packing in the Volt Typhoon activity changed hashes, not behaviour; CISA's advice centres on baselines and logging rather than signatures.
- Delivery formats change fast: ATT&CK added SVG smuggling (.017) and invisible Unicode (.018) as separate sub-techniques, so gateway policies keyed only to older file types fall behind.
- Signed software can carry encrypted payloads: the 3CX supply chain attack used encrypted, embedded components inside a trusted application, so file reputation offered little; behavioural and memory telemetry are the layers that see such components when they run.
Framework mapping
| Framework | References |
|---|---|
| ATT&CK mitigations | M1040 Behavior Prevention on Endpoint, M1049 Antivirus/Antimalware, M1047 Audit, M1038 Execution Prevention, M1017 User Training |
| NIST SP 800-53 Rev. 5 | SI-3 Malicious Code Protection, SI-4 System Monitoring, CM-7 Least Functionality, AU-12 Audit Record Generation |
| NIST CSF 2.0 | DE.CM-09 (monitoring of software and runtime environments), PR.PS-05 (unauthorised software execution prevented), DE.AE-02 (analysis of adverse events) |
| CIS Controls v8.1 | Control 10 Malware Defenses, Control 2 Inventory and Control of Software Assets, Control 9 Email and Web Browser Protections |
| MITRE D3FEND | D3-SEA Script Execution Analysis, D3-FA File Analysis, D3-DA Dynamic Analysis, D3-FCR File Content Rules |
Practitioner checklist
- Enable PowerShell script block logging with Protected Event Logging and forward 4104 centrally.
- Confirm every Windows endpoint has an active AMSI provider and alert on AMSI tampering.
- Run the obfuscated-script, downloaded-content and Office Win32 API ASR rules in Audit, then Block.
- Remove PowerShell 2.0 and restrict compilers and script hosts users do not need.
- Collect full command lines on Windows, Linux and macOS and score obfuscation features.
- Scan new files with entropy-aware YARA rules and review high-entropy executables in user paths.
- Filter HTML, SVG and archive attachments at the mail gateway and preserve Mark-of-the-Web.
- Review registry and WMI repository content for large encoded values each quarter.
Standards and references
- MITRE ATT&CK: Obfuscated Files or Information (T1027)
- MITRE ATT&CK: Command Obfuscation (T1027.010)
- MITRE ATT&CK: Deobfuscate/Decode Files or Information (T1140)
- Microsoft Learn: How the Antimalware Scan Interface helps you defend against malware
- Microsoft Learn: Attack surface reduction rules reference
- Microsoft Learn: about_Logging_Windows
- CISA: PRC State-Sponsored Actors Compromise and Maintain Persistent Access to U.S. Critical Infrastructure (AA24-038A)
- YARA: Math module
Related NHI Mgmt Group resources: CyberChef for Analysts Guide · PowerShell Security Guide · ATT&CK Stealth and Defense Impairment Tactics Guide · Malware Analysis Guide for Defenders · HTML Smuggling Guide