Obfuscated Files or Information detection rulesT1027

Detects commands used by Turla group as reported by ESET in May 2020

windows · process_creation

Detects usage of the "FromBase64String" function in the commandline which is used to decode a base64 encoded string

windows · process_creation

Adversaries may use binary padding to add junk data and change the on-disk representation of malware. This rule detect using dd and truncate to add a junk data to file.

linux

Adversaries may use binary padding to add junk data and change the on-disk representation of malware. This rule detect using dd and truncate to add a junk data to file.

macos · process_creation

Detects a potentially suspicious parent of "csc.exe", which could be a sign of payload delivery.

windows · process_creation

Detects the execution of certutil with either the "decode" or "decodehex" flags to decode base64 or hex encoded files. This can be abused by attackers to decode an encoded payload before execution

windows · process_creation

Detects the execution of certutil with the "encode" flag to encode a file to base64 where the files are located in potentially suspicious locations

windows · process_creation

The CrachMapExec pentesting framework implements a PowerShell obfuscation with some static strings detected by this rule.

windows · process_creation

Detects Obfuscated use of Clip.exe to execute PowerShell

windows · process_creation

Detects Obfuscated use of Clip.exe to execute PowerShell

windows · ps_script

Detects Obfuscated use of Clip.exe to execute PowerShell

windows · ps_module

Detects Obfuscated use of Clip.exe to execute PowerShell

windows

Detects Obfuscated use of Clip.exe to execute PowerShell

windows

Detects all variations of obfuscated powershell IEX invocation code generated by Invoke-Obfuscation framework from the following code block

windows · process_creation

Detects all variations of obfuscated powershell IEX invocation code generated by Invoke-Obfuscation framework from the following code block \u2014

windows · ps_script

Detects all variations of obfuscated powershell IEX invocation code generated by Invoke-Obfuscation framework from the code block cited in the reference section below

windows · ps_module

Detects all variations of obfuscated powershell IEX invocation code generated by Invoke-Obfuscation framework from the code block linked in the references

windows

Detects all variations of obfuscated powershell IEX invocation code generated by Invoke-Obfuscation framework from the code block linked in the references

windows

Detects Obfuscated use of stdin to execute PowerShell

windows · process_creation

Detects Obfuscated use of stdin to execute PowerShell

windows · ps_script

Detects Obfuscated use of stdin to execute PowerShell

windows · ps_module

Detects Obfuscated use of stdin to execute PowerShell

windows

Detects Obfuscated use of stdin to execute PowerShell

windows

Detects Obfuscated use of Environment Variables to execute PowerShell

windows · process_creation

Detects Obfuscated use of Environment Variables to execute PowerShell

windows · ps_script

Detects Obfuscated use of Environment Variables to execute PowerShell

windows · ps_module

Detects Obfuscated use of Environment Variables to execute PowerShell

windows

Detects Obfuscated use of Environment Variables to execute PowerShell

windows

Detects Obfuscated Powershell via VAR++ LAUNCHER

windows · process_creation

Detects Obfuscated Powershell via VAR++ LAUNCHER

windows · ps_script

Detects Obfuscated Powershell via VAR++ LAUNCHER

windows · ps_module

Detects Obfuscated Powershell via VAR++ LAUNCHER

windows

Detects Obfuscated Powershell via VAR++ LAUNCHER

windows

Detects Obfuscated Powershell via Stdin in Scripts

windows · process_creation

Detects Obfuscated Powershell via Stdin in Scripts

windows · ps_script

Detects Obfuscated Powershell via Stdin in Scripts

windows · ps_module

Detects Obfuscated Powershell via Stdin in Scripts

windows

Detects Obfuscated Powershell via Stdin in Scripts

windows

Detects Obfuscated Powershell via use Clip.exe in Scripts

windows · process_creation

Detects Obfuscated Powershell via use Clip.exe in Scripts

windows · ps_script

Detects Obfuscated Powershell via use Clip.exe in Scripts

windows · ps_module

Detects Obfuscated Powershell via use Clip.exe in Scripts

windows

Detects Obfuscated Powershell via use Clip.exe in Scripts

windows

Detects Obfuscated Powershell via use MSHTA in Scripts

windows · process_creation

Detects Obfuscated Powershell via use MSHTA in Scripts

windows · ps_script

Detects Obfuscated Powershell via use MSHTA in Scripts

windows · ps_module

Detects Obfuscated Powershell via use MSHTA in Scripts

windows

Detects Obfuscated Powershell via use MSHTA in Scripts

windows

Detects Obfuscated Powershell via use Rundll32 in Scripts

windows · ps_script

Detects Obfuscated Powershell via use Rundll32 in Scripts

windows · ps_module

Detects Obfuscated Powershell via use Rundll32 in Scripts

windows

Detects Obfuscated Powershell via use Rundll32 in Scripts

windows

Detects the execution of obfuscated PowerShell commands that attempt to install MSI packages via the Windows Installer COM object (`WindowsInstaller.Installer`). The technique involves manipulating strings to hide functionality, such as constructing class names using string insertion (e.g., 'indowsInstaller.Installer'.Insert(0,'W')) and correcting malformed URLs (e.g., converting 'htps://' to 'https://') at runtime. This behavior is commonly associated with malware loaders or droppers that aim to bypass static detection by hiding intent in runtime-generated strings and using legitimate tools for code execution. The use of `InstallProduct` and COM object creation, particularly combined with hidden window execution and suppressed UI, indicates an attempt to install software (likely malicious) without user interaction.

windows · process_creation

Detects activity mentioned in Operation Wocao report

windows · process_creation

Detects activity mentioned in Operation Wocao report

windows

Detects the extraction of password protected ZIP archives. See the filename variable for more details on which file has been opened.

windows

Detects the extraction of password protected ZIP archives with suspicious file names. See the filename variable for more details on which file has been opened.

windows

Detects a ping command that uses a hex encoded IP address

windows · process_creation

Detects potential commandline obfuscation using unicode characters. Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit.

windows · process_creation

Detects all Emotet like process executions that are not covered by the more generic rules

windows · process_creation

Detects the PowerShell command lines with special characters

windows · process_creation

Detects the presence of reversed PowerShell commands in the CommandLine. This is often used as a method of obfuscation by attackers

windows · process_creation

Detects suspicious encoded character syntax often used for defense evasion

windows · process_creation

Detects files dropped by Winnti as described in RedMimicry Winnti playbook

windows · file_event

Detects UTF-8 and UTF-16 Base64 encoded powershell 'Invoke-' calls

windows · process_creation

Detects base64 encoded .NET reflective loading of Assembly

windows · process_creation

Detects calls to base64 encoded WMI class such as "Win32_ShadowCopy", "Win32_ScheduledJob", etc.

windows · process_creation

Detects TOKEN OBFUSCATION technique from Invoke-Obfuscation

windows · process_creation

Detects the execution of a binary from the Linux shared memory directory /dev/shm. This directory is a tmpfs mount backed entirely by RAM and is abused by attackers for fileless malware staging because files written there never touch physical disk and may evade disk-based detection.

linux · process_creation

Detects the use of DefenderCheck, a tool to evaluate the signatures used in Microsoft Defender. It can be used to figure out the strings / byte chains used in Microsoft Defender to detect a tool and thus used for AV evasion.

windows · process_creation

Detects Python one-liners that use base64 decoding functions in command line executions. Malicious scripts or attackers often use python one-liners to decode and execute base64-encoded payloads, which is a common technique for obfuscation and evasion.

windows · process_creation

Detects the use of Python's base64 decoding functions in command line executions on Linux systems. Malicious scripts often use python one-liners to decode and execute base64-encoded payloads, which is a common technique for obfuscation and evasion.

linux · process_creation

Detects the execution of a renamed AutoIt2.exe or AutoIt3.exe. AutoIt is a scripting language and automation tool for Windows systems. While primarily used for legitimate automation tasks, it can be misused in cyber attacks. Attackers can leverage AutoIt to create and distribute malware, including keyloggers, spyware, and botnets. A renamed AutoIt executable is particularly suspicious.

windows · process_creation

Detects suspicious base64 encoded and obfuscated "LOAD" keyword used in .NET "reflection.assembly"

windows · process_creation

Detects process creation with suspicious whitespace padding followed by a '#' character, which may indicate ClickFix or FileFix techniques used to conceal malicious commands from visual inspection. ClickFix and FileFix are social engineering attack techniques where adversaries distribute phishing documents or malicious links that deceive users into opening the Windows Run dialog box or File Explorer search bar. The victims are then instructed to paste commands from their clipboard, which contain extensive whitespace padding using various Unicode space characters to push the actual malicious command far to the right, effectively hiding it from immediate view.

windows · process_creation

Detects the execution of certutil with certain flags that allow the utility to download files from direct IPs.

windows · process_creation

Detects the execution of certutil with certain flags that allow the utility to download files from file-sharing websites.

windows · process_creation

Detects the execution of certutil with the "encode" flag to encode a file to base64 where the extensions of the file is suspicious

windows · process_creation

Detects files with specially crafted filenames that embed Base64-encoded bash payloads designed to execute when processed by shell scripts. These filenames exploit shell interpretation quirks to trigger hidden commands, a technique observed in VShell malware campaigns.

linux · file_event

Get-Variable is a valid PowerShell cmdlet WindowsApps is by default in the path where PowerShell is executed. So when the Get-Variable command is issued on PowerShell execution, the system first looks for the Get-Variable executable in the path and executes the malicious binary instead of looking for the PowerShell cmdlet.

windows · file_event

Detects the occurrence of numerous space characters in RunMRU registry paths, which may indicate execution via phishing lures using clickfix techniques to hide malicious commands in the Windows Run dialog box from naked eyes.

windows · registry_set

Detects the occurrence of numerous space characters in TypedPaths registry paths, which may indicate execution via phishing lures using file-fix techniques to hide malicious commands.

windows · registry_set

Detects a suspicious process creation as SYSTEM user (suspicious program or command line parameter)

windows · process_creation

Detects successful code compilation via Visual Basic Command Line Compiler that utilizes Windows Resource to Object Converter.

windows · process_creation

Detects the execution of the certutil with the "exportPFX" flag which allows the utility to export certificates.

windows · process_creation

Detects usage of the "ConvertTo-SecureString" cmdlet via the commandline. Which is fairly uncommon and could indicate potential suspicious activity

windows · process_creation

Detects execution of "csc.exe" to compile .NET code. Attackers often leverage this to compile code on the fly and use it in other stages.

windows · process_creation

Detects execution of "csc.exe" to compile .NET code. Attackers often leverage this to compile code on the fly and use it in other stages.

windows · process_creation

Detects the execution of certutil with the "encode" flag to encode a file to base64. This can be abused by threat actors and attackers for data exfiltration

windows · process_creation

Detects usage of findstr to identify and execute a lnk file as seen within the HHS redirect attack

windows · process_creation

Detects the invocation of PowerShell commands with references to classes from the "System.Security.Cryptography" namespace. The PowerShell namespace "System.Security.Cryptography" provides classes for on-the-fly encryption and decryption. These can be used for example in decrypting malicious payload for defense evasion.

windows · process_creation

Detects Obfuscated Powershell via COMPRESS OBFUSCATION

windows · process_creation

Detects Obfuscated Powershell via COMPRESS OBFUSCATION

windows · ps_script

Detects Obfuscated Powershell via COMPRESS OBFUSCATION

windows · ps_module

Detects Obfuscated Powershell via COMPRESS OBFUSCATION

windows

Detects Obfuscated Powershell via COMPRESS OBFUSCATION

windows

Detects Obfuscated Powershell via RUNDLL LAUNCHER

windows · ps_script

Detects Obfuscated Powershell via RUNDLL LAUNCHER

windows · ps_module

Detects Obfuscated Powershell via RUNDLL LAUNCHER

windows

Detects Obfuscated Powershell via RUNDLL LAUNCHER

windows

Detects the extraction of password protected ZIP archives. See the filename variable for more details on which file has been opened.

windows

Detects the execution of Dnx.EXE. The Dnx utility allows for the execution of C# code. Attackers might abuse this in order to bypass application whitelisting.

windows · process_creation

Detects potential CommandLine obfuscation using unicode characters. Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit.

windows · process_creation

Detects execution of "rundll32" with potential obfuscated ordinal calls

windows · process_creation

Detects files that have extensions commonly seen while SDelete is used to wipe files.

windows

Detects TOKEN OBFUSCATION technique from Invoke-Obfuscation in Powershell scripts. Use this rule as a threat-hunting baseline to find obfuscated scripts in your environment. Once tested and tuned, consider deploying a production detection rule based on this hunting rule.

windows · ps_script

Detects the use of rcedit to potentially alter executable PE metadata properties, which could conceal efforts to rename system utilities for defense evasion.

windows · process_creation

Detects the setting of a registry inside the "\Shell\Open\Command" value with PowerShell classes from the "System.Security.Cryptography" namespace. The PowerShell namespace "System.Security.Cryptography" provides classes for on-the-fly encryption and decryption. These can be used for example in decrypting malicious payload for defense evasion.

windows · registry_set

Detects the execution of certutil with certain flags that allow the utility to download files.

windows · process_creation

Detects suspicious usage of the cmd.exe 'for /f' loop combined with the 'tokens=' parameter and a recursive directory listing. This pattern may indicate an attempt to discover and execute system binaries dynamically, for example powershell, a technique sometimes used by attackers to evade detection. This behavior has been observed in various malicious lnk files.

windows · process_creation

Detects presence of a potentially xor encoded powershell command

windows · process_creation

Detects usage of base64 utility to decode arbitrary base64-encoded text

linux · process_creation

Detects usage of base64 utility to decode arbitrary base64-encoded text

macos · process_creation

When C# is compiled dynamically, a .cmdline file will be created as a part of the process. Certain processes are not typically observed compiling C# code, but can do so without touching disk. This can be used to unpack a payload for execution

windows · file_event

Detects specific combinations of encoding methods in PowerShell via the commandline

windows · process_creation

Detects Set-Alias or New-Alias cmdlet usage. Which can be use as a mean to obfuscate PowerShell scripts

windows · ps_script

Detects specific techniques often seen used inside of PowerShell scripts to obfscuate Alias creation

windows · ps_script

Detects potential suspicious execution of a GUID like folder name located in a suspicious location such as %TEMP% as seen being used in IcedID attacks. Use this rule to hunt for potentially suspicious activity stemming from uncommon folders.

windows · process_creation

Detects the creation of files with unusually long filenames (100 or more characters), which may indicate obfuscation techniques used by malware such as VShell. This is a hunting rule to identify potential threats that use long filenames to evade detection. Keep in mind that on a legitimate system, such long filenames can and are common. Run this detection in the context of threat hunting rather than alerting. Adjust the threshold of filename length as needed based on your environment.

linux · file_event

Detects the image load of "Python Core" by a non-Python process. This might be indicative of a execution of executable that has been bundled from Python code. Various tools like Py2Exe, PyInstaller, and cx_Freeze are used to bundle Python code into standalone executables. Threat actors often use these tools to bundle malicious Python scripts into executables, sometimes to obfuscate the code or to bypass security measures.

windows · image_load

Detects extraction of files with usage of steghide binary, the adversaries may use this technique to prevent the detection of hidden information.

linux

Detects embedding of files with usage of steghide binary, the adversaries may use this technique to prevent the detection of hidden information.

linux

Detects appending of zip file to image

linux

Detects extracting of zip file from image file

linux

Detects code integrity failures such as missing page hashes or corrupted drivers due unauthorized modification. This could be a sign of tampered binaries.

windows