Applied Cybernetics Group
T1140 Deobfuscate/Decode Files or Information
- Technique
T1140- Tactics
- Defense Evasion
- Research, 90 days
- 11
- KEV CVEs mapped
- 2
- SigmaHQ rules
- 18
- Elastic, Splunk
- 41
- thrunt rules
- 0
- Upstream
- https://attack.mitre.org/techniques/T1140
MITRE description
Adversaries may use [Obfuscated Files or Information](https://attack.mitre.org/techniques/T1027) to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system. One such example is the use of [certutil](https://attack.mitre.org/software/S0160) to decode a remote access tool portable executable file that has been hidden inside a certificate file.(Citation: Malwarebytes Targeted Attack against Saudi Arabia) Another example is using the Windows <code>copy /b</code> or <code>type</code> command to reassemble binary fragments into a malicious payload.(Citation: Carbon Black Obfuscation Sept 2016)(Citation: Sentinel One Tainted Love 2023) Sometimes a user's action may be required to open it for deobfuscation or decryption as part of [User Execution](https://attack.mitre.org/techniques/T1204). The user may also be required to input a password to open a password protected compressed/encrypted file that was provided by the adversary.(Citation: Volexity PowerDuke November 2016)
KEV CVEs mapped to this technique
MITRE CTID maps these KEV CVEs to this technique by hand. They are the actively exploited vulnerabilities behind this technique's KEV signal.
Research citing this technique
Reports and advisories from the last 90 days that cite this technique.
-
2026-11-03Flare: Inside a Microsoft Lookalike Domain Masquerading as Czech Company’s IT Department Infrastructure -
2026-10-30Darktrace: CikaBika Bot: Inside a Discord RAT Campaign -
2026-10-22Group-IB: Inside SiriusQT: A Seriously Skilled RAT -
2026-10-15Google Threat Intelligence: Investigating Ephemeral Supply Chain Tampering -
2026-10-14Group-IB: KGB RAT: A Fully Undetectable Windows Trojan Built to Spy, Steal, and Terrorize -
2026-10-08ESET: MATCHBOIL: New tricks, same old evil intentions -
2026-10-06Flare: CrocoRat Adds a New Twist to ClickFix with DNS Payload Delivery -
2026-09-17ESET: Beware the SparroWock: The backdoor that bites, the commands that catch -
2026-09-14Group-IB: Smish. Click. Drained: Inside the Smishing Triad’s Phishing Cockpit -
2026-09-03Group-IB: The Outsider Phishing Kit: A Resilient Threat in the Face of Law Enforcement Action
Showing the 10 most recent of 11.
Detection coverage
SigmaHQ community rules
- Potential BlackByte Ransomware Activity (emerging-threats)
- UNC4841 - SSL Certificate Exfiltration Via Openssl (emerging-threats)
- UNC4841 - Download Compressed Files From Temp.sh Using Wget (emerging-threats)
- UNC4841 - Download Tar File From Untrusted Direct IP Via Wget (emerging-threats)
- Suspicious Inbox Manipulation Rules (core)
- Linux Base64 Encoded Pipe to Shell (core)
- Linux Base64 Encoded Shebang In CLI (core)
- Linux Shell Pipe to Shell (core)
- Payload Decoded and Decrypted via Built-in Utilities (core)
- Potential Base64 Decoded From Images (core)
- PowerShell Decompress Commands (core)
- MSHTA Execution with Suspicious File Extensions (core)
- Ping Hex IP (core)
- PowerShell Base64 Encoded FromBase64String Cmdlet (core)
- Base64 Encoded PowerShell Command Detected (core)
- Suspicious XOR Encoded PowerShell Command (core)
- Potential Commandline Obfuscation Using Escape Characters (core)
- DNS-over-HTTPS Enabled by Registry (core)
Elastic and Splunk rules
- ROT Encoded Python Script Execution (elastic)
- Long Base64 Encoded Command via Scripting Interpreter (elastic)
- Command Line Obfuscation via Whitespace Padding (elastic)
- Execution via OpenClaw Agent (elastic)
- Web Server Potential Command Injection Request (elastic)
- Decoded Payload Piped to Interpreter Detected via Defend for Containers (elastic)
- Encoded Payload Detected via Defend for Containers (elastic)
- Suspicious Interpreter Execution Detected via Defend for Containers (elastic)
- Suspicious Echo or Printf Execution Detected via Defend for Containers (elastic)
- Azure WireServer OpenSSL Certificate Decrypt or LinuxTransport Generation (elastic)
- Base16 or Base32 Encoding/Decoding Activity (elastic)
- Unusual Base64 Encoding/Decoding Activity (elastic)
- Potential Hex Payload Execution via Command-Line (elastic)
- Potential Hex Payload Execution via Common Utility (elastic)
- Base64 Decoded Payload Piped to Interpreter (elastic)
- Multi-Base64 Decoding Attempt from Suspicious Location (elastic)
- Kernel Unpacking Activity (elastic)
- Suspicious Execution from Foomatic-rip or Cupsd Parent (elastic)
- Suspicious Content Extracted or Decompressed via Funzip (elastic)
- Suspicious .NET Reflection via PowerShell (elastic)
- PowerShell Suspicious Payload Encoded and Compressed (elastic)
- PowerShell Script with Encryption/Decryption Capabilities (elastic)
- Potential PowerShell Obfuscated Script via High Entropy (elastic)
- Potential PowerShell Obfuscation via Invalid Escape Sequences (elastic)
- Potential PowerShell Obfuscation via Backtick-Escaped Variable Expansion (elastic)
Showing 25 of 41.