MITRE ATT&CK T1140 Deobfuscate/Decode Files or Information: Detecting Evasion

Every encoded, encrypted or split payload has to be turned back into something runnable on the target, and that decoding step is one of the few moments where a hidden payload must show itself. MITRE ATT&CK T1140 Deobfuscate/Decode Files or Information covers the mechanisms adversaries use to reverse their own obfuscation, either inside the malware or with utilities already on the system such as certutil, base64, openssl or archive tools. In ATT&CK v20 it sits in the Stealth tactic (TA0005), applies to ESXi, Linux, macOS and Windows, has no sub-techniques and no listed mitigations, and is recorded for more than 350 groups, campaigns and software families. This guide is the defender's view of the decode step: which utilities and patterns appear in real procedures, the telemetry and sequences that catch them, the controls that remove the easy paths, and how to test coverage. It is for detection engineers, threat hunters and SOC analysts. The hiding side of the same coin is covered in the T1027 Obfuscated Files or Information Defensive Guide, and the analyst's decoding workbench in the CyberChef for Analysts Guide.

Key takeaways

• Decoding is a sequence, not an event. ATT&CK's analytics look for a decoding tool that runs shortly after a file is staged or downloaded and is followed by a script interpreter or new executable. Alert on the chain, not on certutil alone.
• Built-in utilities are the detectable half. In-memory decryption inside malware (XOR, RC4, AES routines) leaves little host evidence; certutil, base64, openssl, expand, tar and 7-Zip leave process and file events you can collect today.
• There is no ATT&CK mitigation, so prevention is indirect. v20 lists none for T1140. Application control on the follow-on payload, AMSI-aware script hosts and attachment policy do the preventive work.
• Linux, macOS and ESXi matter too. v20 adds dedicated analytics for base64, gzip, tar and openssl chained with downloaders on Linux, and base64 -d or osascript on macOS.
• Base64 is not protection for secrets. The same decoding that hides malware also exposes credentials that teams only encoded, such as Kubernetes Secret values.

What T1140 covers

ATT&CK describes T1140 as the counterpart to T1027: adversaries hide artifacts, then "may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it", either through built-in malware functionality or "by using utilities present on the system". The technique page gives three reference patterns: certutil decoding a remote access tool hidden inside a certificate file, the Windows copy /b or type commands reassembling binary fragments, and a user typing a password to open an adversary-supplied encrypted archive as part of T1204 User Execution.

How adversaries use it

The v20 procedure examples show the same few patterns across very different actors. Attribution below is as ATT&CK records it.

• certutil as a decoder: APT28 macros ran certutil -decode against a text file holding a Base64 payload; menuPass, OilRig, FIN13, Higaisa and Earth Lusca used certutil the same way; Volt Typhoon used Base64-encoded payloads and commands with deobfuscation through certutil. CERT Polska's reporting on the 2025 Poland wiper attacks (ATT&CK campaign C0063) records adversaries decoding a Base64-encoded ZIP archive with certutil. See the Volt Typhoon Threat Actor Profile and the APT28 (Fancy Bear) Threat Actor Profile.
• Script-level decoding: Kimsuky decoded VBScript and PowerShell with Base64; WIRTE decoded a VBS script; during campaign C0021, whose artifacts ATT&CK says overlap with APT29, the actors split the method name into 'FromBase'+0x40+'String' so that a search for FromBase64String would miss it. See the Kimsuky Threat Actor Profile.
• Archive tools: during the SolarWinds compromise (C0024) ATT&CK records APT29 using 7-Zip to decode the Raindrop loader; APT28 unarchived data with the WinRAR GUI during the Nearest Neighbor campaign; BBSRAT used expand to decompress a CAB file into executable content.
• Loaders that decrypt themselves: APT41's DUSTPAN and DUSTTRAP decrypt embedded payloads; LockBit 3.0 decrypts its payload at runtime; FIN7 decoded a script with certutil and an XOR block that led to the Lizar tool. See the FIN7 Threat Actor Profile and LockBit Threat Actor Profile.
• Edge device implants: SLIGHTPULSE decodes Base64 and RC4 C2 messages and RAPIDPULSE decrypts an HTTP parameter with a hard-coded RC4 key on Pulse Secure appliances, where defenders rarely have process telemetry at all. See the UNC5221 (Ivanti exploitation) threat actor profile.

What to detect and where

ATT&CK v20 detection strategy DET0275, "Detect Adversary Deobfuscation or Decoding of Files and Payloads", has three platform analytics.

Analytics that work in practice

1. certutil with decode verbs: Microsoft documents -decode as "Decodes a Base64-encoded file" and -decodehex as decoding a hexadecimal-encoded file. Alert on either from any parent other than a known PKI administration script, and raise severity when the parent is an Office application, a script host or an archive tool. Key on the OriginalFileName so a renamed copy is still matched.
2. Decode then execute: correlate a file written by a decoding or archive process with a process start or image load of that same file within minutes. This is the highest-fidelity form of AN0767 and AN0768.
3. Download, decode, run on Linux: curl or wget writing a file, then base64 -d, openssl enc -d or tar on it, then chmod or execution, all from the same session or service account. See the Linux Logging and auditd for Defenders Guide.
4. Script blocks containing decode routines: PowerShell event 4104 content with FromBase64String, [Convert]::, XOR loops or string concatenation that builds those names. Because C0021 split the method name, also match fragments such as FromBase and string concatenation that builds .NET method names, and rely on AMSI, which inspects content at the point it is evaluated. See the PowerShell Security Guide.
5. Fragment reassembly: cmd.exe running copy /b with several inputs where the output has a PE header or a .dll or .exe name.
6. ESXi: ATT&CK v20 lists ESXi as a platform but provides no ESXi analytic. Forward ESXi shell and host logs and look for decoding or archive commands in shell sessions, which are rare on a hypervisor. See the ESXi Logs Detection Guide.

Noise and baselining

• Software deployment: installers and configuration management tools extract archives constantly. Baseline by parent process and signing identity, not by tool name.
• PKI administration: certutil is a certificate tool; its legitimate verbs (-verify, -dump, store operations) far outnumber decode verbs. Restrict alerting to the decode verbs.
• Developers and data teams: base64 and openssl appear in build scripts. Scope Linux analytics to production servers and service accounts where an interactive decode is unexpected.

Prevention and hardening

ATT&CK v20 lists no mitigations for T1140, because decoding uses functionality that systems need. The controls below are NHI Mgmt Group recommendations that act on the decode step or on what it produces, mapped to the ATT&CK mitigation each one implements.

Where identity fits

Encoding is not access control. Kubernetes documentation warns that Secrets "are, by default, stored unencrypted in the API server's underlying data store (etcd)" and that anyone authorised to create a Pod in a namespace can read any Secret in it. Secret values in manifests, CI variables and configuration files are frequently only Base64-encoded, so the same one-line decode that reveals a payload reveals an API key or service account token. Treat any encoded credential found during an investigation as exposed and rotate it, and see the Secrets Management Guide. On the detection side, scope the Linux decode analytics to service accounts and CI runner identities: an automation identity that suddenly decodes and executes a downloaded file is a strong signal.

How to test coverage

1. Inventory telemetry: confirm Sysmon 1 and 11 (or EDR equivalents), PowerShell 4104, auditd execve or EDR command lines on Linux, and the macOS unified log are collected for the hosts in scope. See the Sysmon Guide.
2. Emulate safely: in a test ring, decode a harmless Base64 text file with certutil and base64, extract a benign archive with 7-Zip and tar, and reassemble two harmless fragments. Use an approved emulation framework rather than real malware.
3. Check each analytic fires and that the decode-then-execute correlation links the written file to its later execution.
4. Measure noise for 14 days in audit mode and add exclusions by parent and signer, each with an owner and expiry.
5. Roll back by disabling individual rules rather than whole telemetry sources, and re-run the emulation after every EDR or Sysmon configuration change.

Metrics

• Percentage of Windows, Linux and macOS endpoints sending the data components DET0275 relies on.
• Count of certutil decode-verb executions per week, and the share with an explained parent.
• Mean time from a decode-then-execute alert to triage.
• Number of encoded credentials found in investigations and the time to rotate them.

Lessons from incidents

In the SolarWinds supply chain compromise, ATT&CK's campaign record (C0024) lists APT29 using 7-Zip to decode the Raindrop loader. An archive tool on a server is usually unremarkable, which is the point: decode activity blends in unless detections ask what was extracted, by which parent, and what ran next. The broader lesson from the procedure list is that certutil decode chains have been used by state actors and criminal groups for years and remain cheap to detect, while in-memory decryption by loaders needs EDR and memory analysis to see at all.

Common failure patterns

• Alerting on certutil by name only: floods analysts with PKI activity and misses renamed copies. Alert on decode verbs and on OriginalFileName.
• No link between decode and execution: each event looks benign on its own; the sequence is the detection.
• Windows-only coverage: v20 has Linux and macOS analytics, and attackers use base64 and openssl on servers and build hosts.
• Script logging off or uncollected: PowerShell decoding is invisible without event 4104 and AMSI.
• Treating encoded secrets as safe: Base64 values in configuration and Kubernetes manifests are readable by anyone with the file.

Framework mapping

Practitioner checklist

• Deploy the decode-then-execute correlation for certutil, expand, archive tools and copy /b on Windows.
• Deploy Linux and macOS analytics for base64, openssl, tar and gzip after a download, scoped to servers and service accounts.
• Enable PowerShell script block logging and confirm AMSI is active for script hosts and Office macros.
• Turn on the obfuscated scripts and script-launching-download ASR rules, audit first.
• Block execution of new binaries from user-writable paths with application control.
• Quarantine password-protected archives from external senders.
• Forward ESXi shell logs and alert on decode or archive commands on hypervisors.
• Rotate any credential found only Base64-encoded during an investigation.

Standards and references

• MITRE ATT&CK: Deobfuscate/Decode Files or Information (T1140)
• MITRE ATT&CK: Obfuscated Files or Information (T1027)
• MITRE ATT&CK: certutil (S0160)
• Microsoft: certutil command reference
• Microsoft: Antimalware Scan Interface (AMSI)
• Microsoft: Attack surface reduction rules reference
• Kubernetes: Secrets
• NIST: SP 800-53 Rev. 5 Security and Privacy Controls

Related NHI Mgmt Group resources: T1027 Obfuscated Files or Information Defensive Guide · CyberChef for Analysts Guide · Living off the Land Guide · ATT&CK Stealth and Defense Impairment Tactics Guide