T1027.009 Embedded Payloads

Technique: T1027.009
Tactics: Defense Evasion
Research, 90 days: 3
KEV CVEs mapped: 0
SigmaHQ rules: 2
Elastic, Splunk: 0
thrunt rules: 0
Upstream: https://attack.mitre.org/techniques/T1027/009

MITRE description

Adversaries may embed payloads within other files to conceal malicious content from defenses. Otherwise seemingly benign files (such as scripts and executables) may be abused to carry and obfuscate malicious payloads and content. In some cases, embedded payloads may also enable adversaries to [Subvert Trust Controls](https://attack.mitre.org/techniques/T1553) by not impacting execution controls such as digital signatures and notarization tickets.(Citation: Sentinel Labs) Adversaries may embed payloads in various file formats to hide payloads.(Citation: Microsoft Learn) This is similar to [Steganography](https://attack.mitre.org/techniques/T1027/003), though does not involve weaving malicious content into specific bytes and patterns related to legitimate digital media formats.(Citation: GitHub PSImage) For example, adversaries have been observed embedding payloads within or as an overlay of an otherwise benign binary.(Citation: Securelist Dtrack2) Adversaries have also been observed nesting payloads (such as executables and run-only scripts) inside a file of the same format.(Citation: SentinelLabs reversing run-only applescripts 2021) Embedded content may also be used as [Process Injection](https://attack.mitre.org/techniques/T1055) payloads used to infect benign system processes.(Citation: Trend Micro) These embedded then injected payloads may be used as part of the modules of malware designed to provide specific features such as encrypting C2 communications in support of an orchestrator module. For example, an embedded module may be injected into default browsers, allowing adversaries to then communicate via the network.(Citation: Malware Analysis Report ComRAT)

Research citing this technique

Reports and advisories from the last 90 days that cite this technique.

2026-11-03 ESET: Gorbag: Orcs at the border harvesting intelligence from Ukraine
2026-10-08 Zscaler ThreatLabz: Suspected TraderTraitor Group Uses Trojanized Terraform Provider to Deliver Cross-Platform Malware
2026-08-13 Recorded Future Insikt: Malware Crypting Services and the Threat Actors Who Sell Them

Detection coverage

SigmaHQ community rules

Powershell Token Obfuscation - Powershell (threat-hunting)
Powershell Token Obfuscation - Process Creation (core)

Signal counts reflect the current corpus snapshot. Research citations are the technique IDs named in vendor reports and government advisories from the last 90 days; KEV mappings come from MITRE CTID. Coverage is the SigmaHQ rule inventory (core, emerging-threats, threat-hunting) at release r2026-07-01 plus Elastic and Splunk production rules. Rule bodies are not mirrored; links go upstream.