Description
Adversaries may obfuscate content during command execution to impede detection. Command-line obfuscation is a method of making strings and patterns within commands and scripts more difficult to signature and analyze. This type of obfuscation can be included within commands executed by delivered payloads (e.g., Phishing and Drive-by Compromise) or interactively via Command and Scripting Interpreter.(Citation: Akamai JS)(Citation: Malware Monday VBE)
For example, adversaries may abuse syntax that utilizes various symbols and escape characters (such as spacing, ^, +. $, and %) to make commands difficult to analyze while maintaining the same intended functionality.(Citation: RC PowerShell) Many languages support built-in obfuscation in the form of base64 or URL encoding.(Citation: Microsoft PowerShellB64) Adversaries may also manually implement command obfuscation via string splitting (“Wor”+“d.Application”), order and casing of characters (rev <<<'dwssap/cte/ tac'), globing (mkdir -p '/tmp/:&$NiA'), as well as various tricks involving passing strings through tokens/environment variables/input streams.(Citation: Bashfuscator Command Obfuscators)(Citation: FireEye Obfuscation June 2017)
Adversaries may also use tricks such as directory traversals to obfuscate references to the binary being invoked by a command (C:\voi\pcw\..\..\Windows\tei\qs\k\..\..\..\system32\erool\..\wbem\wg\je\..\..\wmic.exe shadowcopy delete).(Citation: Twitter Richard WMIC)
Tools such as Invoke-Obfuscation and Invoke-DOSfucation have also been used to obfuscate commands.(Citation: Invoke-DOSfuscation)(Citation: Invoke-Obfuscation)
Platforms
Mitigations (2)
Behavior Prevention on EndpointM1040
On Windows 10+, enable Attack Surface Reduction (ASR) rules to block execution of potentially obfuscated scripts.(Citation: Microsoft ASR Obfuscation)
Antivirus/AntimalwareM1049
Consider utilizing the Antimalware Scan Interface (AMSI) on Windows 10+ to analyze commands after being processed/interpreted.
Threat Groups (29)
| ID | Group | Context |
|---|---|---|
| G0094 | Kimsuky | [Kimsuky](https://attack.mitre.org/groups/G0094) has encoded malicious PowerShell scripts using Base64.(Citation: Securonix Kimsuky February 2025) |
| G0040 | Patchwork | [Patchwork](https://attack.mitre.org/groups/G0040) has obfuscated a script with Crypto Obfuscator.(Citation: TrendMicro Patchwork Dec 2017) |
| G0050 | APT32 | [APT32](https://attack.mitre.org/groups/G0050) has used the `Invoke-Obfuscation` framework to obfuscate their PowerShell.(Citation: FireEye APT32 May ... |
| G0069 | MuddyWater | [MuddyWater](https://attack.mitre.org/groups/G0069) has used Daniel Bohannon’s Invoke-Obfuscation framework and obfuscated PowerShell scripts.(Citatio... |
| G0037 | FIN6 | [FIN6](https://attack.mitre.org/groups/G0037) has used encoded PowerShell commands.(Citation: Visa FIN6 Feb 2019) |
| G0047 | Gamaredon Group | [Gamaredon Group](https://attack.mitre.org/groups/G0047) has used obfuscated or encrypted scripts.(Citation: ESET Gamaredon June 2020)(Citation: Micro... |
| G0077 | Leafminer | [Leafminer](https://attack.mitre.org/groups/G0077) obfuscated scripts that were used on victim machines.(Citation: Symantec Leafminer July 2018) |
| G0046 | FIN7 | [FIN7](https://attack.mitre.org/groups/G0046) has used fragmented strings, environment variables, standard input (stdin), and native character-replace... |
| G0034 | Sandworm Team | [Sandworm Team](https://attack.mitre.org/groups/G0034) has used ROT13 encoding, AES encryption and compression with the zlib library for their Python-... |
| G0121 | Sidewinder | [Sidewinder](https://attack.mitre.org/groups/G0121) has used base64 encoding for scripts.(Citation: ATT Sidewinder January 2021)(Citation: Rewterz Sid... |
| G1052 | Contagious Interview | [Contagious Interview](https://attack.mitre.org/groups/G1052) has obfuscated JavaScript code using Base64 and variable substitutions.(Citation: ESET C... |
| G0143 | Aquatic Panda | [Aquatic Panda](https://attack.mitre.org/groups/G0143) has encoded PowerShell commands in Base64.(Citation: CrowdStrike AQUATIC PANDA December 2021) |
| G0010 | Turla | [Turla](https://attack.mitre.org/groups/G0010) has used encryption (including salted 3DES via [PowerSploit](https://attack.mitre.org/software/S0194)'s... |
| G0092 | TA505 | [TA505](https://attack.mitre.org/groups/G0092) has used base64 encoded PowerShell commands.(Citation: Cybereason TA505 April 2019)(Citation: Deep Inst... |
| G0114 | Chimera | [Chimera](https://attack.mitre.org/groups/G0114) has encoded PowerShell commands.(Citation: Cycraft Chimera April 2020) |
| G1051 | Medusa Group | [Medusa Group](https://attack.mitre.org/groups/G1051) has obfuscated PowerShell scripts with Base64 encoding.(Citation: CISA Medusa Group Medusa Ranso... |
| G0127 | TA551 | [TA551](https://attack.mitre.org/groups/G0127) has used obfuscated variable names in a JavaScript configuration file.(Citation: Unit 42 Valak July 202... |
| G0140 | LazyScripter | [LazyScripter](https://attack.mitre.org/groups/G0140) has leveraged the BatchEncryption tool to perform advanced batch script obfuscation and encoding... |
| G0117 | Fox Kitten | [Fox Kitten](https://attack.mitre.org/groups/G0117) has base64 encoded scripts to avoid detection.(Citation: CISA AA20-259A Iran-Based Actor September... |
| G0115 | GOLD SOUTHFIELD | [GOLD SOUTHFIELD](https://attack.mitre.org/groups/G0115) has executed base64 encoded PowerShell scripts on compromised hosts.(Citation: Tetra Defense ... |
Associated Software (35)
| ID | Name | Type | Context |
|---|---|---|---|
| S9029 | IronWind | Malware | [IronWind](https://attack.mitre.org/software/S9029) has used Base64 encoding and XOR encryption with the key “53” to obfuscate command strings.(Citati... |
| S1085 | Sardonic | Malware | [Sardonic](https://attack.mitre.org/software/S1085) PowerShell scripts can be encrypted with RC4 and compressed using Gzip.(Citation: Bitdefender Sard... |
| S0386 | Ursnif | Malware | [Ursnif](https://attack.mitre.org/software/S0386) droppers execute base64 encoded [PowerShell](https://attack.mitre.org/techniques/T1059/001) commands... |
| S9034 | Tsundere Botnet | Malware | [Tsundere Botnet](https://attack.mitre.org/software/S9034)’s MSI installer has Base64-encoded command execution.(Citation: SecureListUbiedo_Tsundere_N... |
| S0330 | Zeus Panda | Malware | [Zeus Panda](https://attack.mitre.org/software/S0330) obfuscates the macro commands in its initial payload.(Citation: Talos Zeus Panda Nov 2017) |
| S1229 | Havoc | Malware | [Havoc](https://attack.mitre.org/software/S1229) has utilized XOR encryption with the key “01-01-1900” to obfuscate command strings.(Citation: Check P... |
| S0462 | CARROTBAT | Malware | [CARROTBAT](https://attack.mitre.org/software/S0462) has the ability to execute obfuscated commands on the infected host.(Citation: Unit 42 CARROTBAT ... |
| S0367 | Emotet | Malware | [Emotet](https://attack.mitre.org/software/S0367) has obfuscated macros within malicious documents to hide the URLs hosting the malware, CMD.exe argu... |
| S1081 | BADHATCH | Malware | [BADHATCH](https://attack.mitre.org/software/S1081) malicious PowerShell commands can be encoded with base64.(Citation: BitDefender BADHATCH Mar 2021)... |
| S0409 | Machete | Malware | [Machete](https://attack.mitre.org/software/S0409) has used pyobfuscate, zlib compression, and base64 encoding for obfuscation. [Machete](https://atta... |
| S0277 | FruitFly | Malware | [FruitFly](https://attack.mitre.org/software/S0277) executes and stores obfuscated Perl scripts.(Citation: objsee mac malware 2017) |
| S0673 | DarkWatchman | Malware | [DarkWatchman](https://attack.mitre.org/software/S0673) has used Base64 to encode PowerShell commands.(Citation: Prevailion DarkWatchman 2021) |
| S0450 | SHARPSTATS | Malware | [SHARPSTATS](https://attack.mitre.org/software/S0450) has used base64 encoding and XOR to obfuscate PowerShell scripts.(Citation: TrendMicro POWERSTAT... |
| S0457 | Netwalker | Malware | [Netwalker](https://attack.mitre.org/software/S0457)'s PowerShell script has been obfuscated with multiple layers including base64 and hexadecimal enc... |
| S0269 | QUADAGENT | Malware | [QUADAGENT](https://attack.mitre.org/software/S0269) was likely obfuscated using `Invoke-Obfuscation`.(Citation: Unit 42 QUADAGENT July 2018)(Citation... |
| S1240 | RedLine Stealer | Malware | [RedLine Stealer](https://attack.mitre.org/software/S1240) has obfuscated scripts within text files used in execution.(Citation: McAfee RedLine Steale... |
| S0270 | RogueRobin | Malware | The PowerShell script with the [RogueRobin](https://attack.mitre.org/software/S0270) payload was obfuscated using the COMPRESS technique in `Invoke-Ob... |
| S0390 | SQLRat | Malware | [SQLRat](https://attack.mitre.org/software/S0390) has used a character insertion obfuscation technique, making the script appear to contain Chinese ch... |
| S0589 | Sibot | Malware | [Sibot](https://attack.mitre.org/software/S0589) has obfuscated scripts used in execution.(Citation: MSTIC NOBELIUM Mar 2021) |
| S0475 | BackConfig | Malware | [BackConfig](https://attack.mitre.org/software/S0475) has used compressed and decimal encoded VBS scripts.(Citation: Unit 42 BackConfig May 2020) |
References
- Ackroyd, R. (2023, March 24). Twitter. Retrieved September 12, 2024.
- Bohannon, D. (2016, September 24). Invoke-Obfuscation. Retrieved March 17, 2023.
- Bohannon, D. (2018, March 19). Invoke-DOSfuscation. Retrieved March 17, 2023.
- Bohannon, D. & Carr N. (2017, June 30). Obfuscation in the Wild: Targeted Attackers Lead the Way in Evasion Techniques. Retrieved February 12, 2018.
- Bromiley, M. (2016, December 27). Malware Monday: VBScript and VBE Files. Retrieved March 17, 2023.
- Katz, O. (2020, October 26). Catch Me if You Can—JavaScript Obfuscation. Retrieved March 17, 2023.
- LeFevre, A. (n.d.). Bashfuscator Command Obfuscators. Retrieved March 17, 2023.
- Microsoft. (2023, February 8). about_PowerShell_exe: EncodedCommand. Retrieved March 17, 2023.
- Red Canary. (n.d.). 2022 Threat Detection Report: PowerShell. Retrieved March 17, 2023.
Frequently Asked Questions
What is T1027.010 (Command Obfuscation)?
T1027.010 is a MITRE ATT&CK technique named 'Command Obfuscation'. It belongs to the Stealth tactic(s). Adversaries may obfuscate content during command execution to impede detection. Command-line obfuscation is a method of making strings and patterns within commands and scripts more difficult to signat...
How can T1027.010 be detected?
Detection of T1027.010 (Command Obfuscation) typically involves monitoring system logs, network traffic, and endpoint telemetry. Use SIEM rules, EDR solutions, and behavioral analytics to identify suspicious activity associated with this technique.
What mitigations exist for T1027.010?
There are 2 documented mitigations for T1027.010. Key mitigations include: Behavior Prevention on Endpoint, Antivirus/Antimalware.
Which threat groups use T1027.010?
Known threat groups using T1027.010 include: Kimsuky, Patchwork, APT32, MuddyWater, FIN6, Gamaredon Group, Leafminer, FIN7.