Description
Adversaries may encrypt or encode files to obfuscate strings, bytes, and other specific patterns to impede detection. Encrypting and/or encoding file content aims to conceal malicious artifacts within a file used in an intrusion. Many other techniques, such as Software Packing, Steganography, and Embedded Payloads, share this same broad objective. Encrypting and/or encoding files could lead to a lapse in detection of static signatures, only for this malicious content to be revealed (i.e., Deobfuscate/Decode Files or Information) at the time of execution/use.
This type of file obfuscation can be applied to many file artifacts present on victim hosts, such as malware log/configuration and payload files.(Citation: File obfuscation) Files can be encrypted with a hardcoded or user-supplied key, as well as otherwise obfuscated using standard encoding schemes such as Base64.
The entire content of a file may be obfuscated, or just specific functions or values (such as C2 addresses). Encryption and encoding may also be applied in redundant layers for additional protection.
For example, adversaries may abuse password-protected Word documents or self-extracting (SFX) archives as a method of encrypting/encoding a file such as a Phishing payload. These files typically function by attaching the intended archived content to a decompressor stub that is executed when the file is invoked (e.g., User Execution).(Citation: SFX - Encrypted/Encoded File)
Adversaries may also abuse file-specific as well as custom encoding schemes. For example, Byte Order Mark (BOM) headers in text files may be abused to manipulate and obfuscate file content until Command and Scripting Interpreter execution.
Platforms
Mitigations (2)
Behavior Prevention on EndpointM1040
On Windows 10+, enable Attack Surface Reduction (ASR) rules to block execution of potentially obfuscated scripts.(Citation: Obfuscated scripts)
Security tools should be configured to analyze the encoding properties of files and detect anomalies that deviate from standard encoding practices.
Antivirus/AntimalwareM1049
Anti-virus can be used to automatically detect and quarantine suspicious files, including those with high entropy measurements or with otherwise potentially malicious signs of obfuscation.
Threat Groups (40)
| ID | Group | Context |
|---|---|---|
| G0066 | Elderwood | [Elderwood](https://attack.mitre.org/groups/G0066) has encrypted documents and malicious executables.(Citation: Symantec Elderwood Sept 2012) |
| G0094 | Kimsuky | [Kimsuky](https://attack.mitre.org/groups/G0094) has obfuscated code within files by converting hexadecimal strings to decimal numbers using the `CLng... |
| G0045 | menuPass | [menuPass](https://attack.mitre.org/groups/G0045) has encoded strings in its malware with base64 as well as with a simple, single-byte XOR obfuscation... |
| G0050 | APT32 | [APT32](https://attack.mitre.org/groups/G0050) has performed code obfuscation, including encoding payloads using Base64 and using a framework called "... |
| G1046 | Storm-1811 | [Storm-1811](https://attack.mitre.org/groups/G1046) XOR encodes a [Cobalt Strike](https://attack.mitre.org/software/S0154) installation payload in a D... |
| G0139 | TeamTNT | [TeamTNT](https://attack.mitre.org/groups/G0139) has encrypted its binaries via AES and encoded files using Base64.(Citation: Trend Micro TeamTNT)(Cit... |
| G0026 | APT18 | [APT18](https://attack.mitre.org/groups/G0026) obfuscates strings in the payload.(Citation: PaloAlto DNS Requests May 2016) |
| G0121 | Sidewinder | [Sidewinder](https://attack.mitre.org/groups/G0121) has used base64 encoding and ECDH-P256 encryption for payloads.(Citation: ATT Sidewinder January 2... |
| G0087 | APT39 | [APT39](https://attack.mitre.org/groups/G0087) has used malware to drop encrypted CAB files.(Citation: FBI FLASH APT39 September 2020) |
| G1052 | Contagious Interview | [Contagious Interview](https://attack.mitre.org/groups/G1052) has used hexadecimal string encoding to hide critical JavaScript module names, function ... |
| G1018 | TA2541 | [TA2541](https://attack.mitre.org/groups/G1018) has used compressed and char-encoded scripts in operations.(Citation: Cisco Operation Layover Septemb... |
| G1009 | Moses Staff | [Moses Staff](https://attack.mitre.org/groups/G1009) has used obfuscated web shells in their operations.(Citation: Checkpoint MosesStaff Nov 2021) |
| G0049 | OilRig | [OilRig](https://attack.mitre.org/groups/G0049) has encrypted and encoded data in its malware, including by using base64.(Citation: FireEye APT34 Dec ... |
| G0126 | Higaisa | [Higaisa](https://attack.mitre.org/groups/G0126) used Base64 encoded compressed payloads.(Citation: Malwarebytes Higaisa 2020)(Citation: Zscaler Higai... |
| G0081 | Tropic Trooper | [Tropic Trooper](https://attack.mitre.org/groups/G0081) has encrypted configuration files.(Citation: TrendMicro Tropic Trooper Mar 2018)(Citation: Tre... |
| G0024 | Putter Panda | Droppers used by [Putter Panda](https://attack.mitre.org/groups/G0024) use RC4 or a 16-byte XOR key consisting of the bytes 0xA0 – 0xAF to obfuscate p... |
| G1031 | Saint Bear | [Saint Bear](https://attack.mitre.org/groups/G1031) initial payloads included encoded follow-on payloads located in the resources file of the first-st... |
| G0065 | Leviathan | [Leviathan](https://attack.mitre.org/groups/G0065) has obfuscated code using base64.(Citation: Proofpoint Leviathan Oct 2017) |
| G0043 | Group5 | [Group5](https://attack.mitre.org/groups/G0043) disguised its malicious binaries with several layers of obfuscation, including encrypting the files.(C... |
| G0108 | Blue Mockingbird | [Blue Mockingbird](https://attack.mitre.org/groups/G0108) has obfuscated the wallet address in the payload binary.(Citation: RedCanary Mockingbird May... |
Associated Software (195)
| ID | Name | Type | Context |
|---|---|---|---|
| S0266 | TrickBot | Malware | [TrickBot](https://attack.mitre.org/software/S0266) uses an AES CBC (256 bits) encryption algorithm for its loader and configuration files.(Citation: ... |
| S0520 | BLINDINGCAN | Malware | [BLINDINGCAN](https://attack.mitre.org/software/S0520) has obfuscated code using Base64 encoding.(Citation: US-CERT BLINDINGCAN Aug 2020) |
| S1100 | Ninja | Malware | The [Ninja](https://attack.mitre.org/software/S1100) payload is XOR encrypted and compressed.(Citation: Kaspersky ToddyCat Check Logs October 2023) [N... |
| S9015 | BRICKSTORM | Malware | [BRICKSTORM](https://attack.mitre.org/software/S9015) has utilized XOR cipher encryption to hide key strings within their code, to include IPv4 addres... |
| S0678 | Torisma | Malware | [Torisma](https://attack.mitre.org/software/S0678) has been Base64 encoded and AES encrypted.(Citation: McAfee Lazarus Nov 2020) |
| S0213 | DOGCALL | Malware | [DOGCALL](https://attack.mitre.org/software/S0213) is encrypted using single-byte XOR.(Citation: Unit 42 Nokki Oct 2018) |
| S0603 | Stuxnet | Malware | [Stuxnet](https://attack.mitre.org/software/S0603) uses encrypted configuration blocks and writes encrypted files to disk.(Citation: Nicolas Falliere,... |
| S1220 | MEDUSA | Malware | [MEDUSA](https://attack.mitre.org/software/S1220) can XOR encrypt configuration strings.(Citation: Google Cloud Mandiant UNC3886 2024) |
| S1154 | VersaMem | Malware | [VersaMem](https://attack.mitre.org/software/S1154) encrypted captured credentials with AES then Base64 encoded them before writing to local storage.(... |
| S1041 | Chinoxy | Malware | [Chinoxy](https://attack.mitre.org/software/S1041) has encrypted its configuration file.(Citation: Bitdefender FunnyDream Campaign November 2020) |
| S1233 | PAKLOG | Malware | [PAKLOG](https://attack.mitre.org/software/S1233) has utilized a simple encoding mechanism to encode characters in the buffer.(Citation: Zscaler PAKLO... |
| S0226 | Smoke Loader | Malware | [Smoke Loader](https://attack.mitre.org/software/S0226) uses a simple one-byte XOR method to obfuscate values in the malware.(Citation: Malwarebytes S... |
| S0466 | WindTail | Malware | [WindTail](https://attack.mitre.org/software/S0466) can be delivered as a compressed, encrypted, and encoded payload.(Citation: objective-see windtail... |
| S0082 | Emissary | Malware | Variants of [Emissary](https://attack.mitre.org/software/S0082) encrypt payloads using various XOR ciphers, as well as a custom algorithm that uses th... |
| S0401 | Exaramel for Linux | Malware | [Exaramel for Linux](https://attack.mitre.org/software/S0401) uses RC4 for encrypting the configuration.(Citation: ESET TeleBots Oct 2018)(Citation: A... |
| S0391 | HAWKBALL | Malware | [HAWKBALL](https://attack.mitre.org/software/S0391) has encrypted the payload with an XOR-based algorithm.(Citation: FireEye HAWKBALL Jun 2019) |
| S0613 | PS1 | Malware | [PS1](https://attack.mitre.org/software/S0613) is distributed as a set of encrypted files and scripts.(Citation: BlackBerry CostaRicto November 2020) |
| S9018 | HeartCrypt | Malware | [HeartCrypt](https://attack.mitre.org/software/S9018) strings are encrypted via a single-byte XOR operation rotating over a hard-coded key, possibly p... |
| S0386 | Ursnif | Malware | [Ursnif](https://attack.mitre.org/software/S0386) has used an XOR-based algorithm to encrypt Tor clients dropped to disk.(Citation: ProofPoint Ursnif ... |
| S0665 | ThreatNeedle | Malware | [ThreatNeedle](https://attack.mitre.org/software/S0665) has been compressed and obfuscated using RC4, AES, or XOR.(Citation: Kaspersky ThreatNeedle Fe... |
References
- Aspen Lindblom, Joseph Goodwin, and Chris Sheldon. (2021, July 19). Shlayer Malvertising Campaigns Still Using Flash Update Disguise. Retrieved March 29, 2024.
- Jai Minton. (2023, March 31). How Falcon OverWatch Investigates Malicious Self-Extracting Archives, Decoy Files and Their Hidden Payloads. Retrieved March 29, 2024.
Frequently Asked Questions
What is T1027.013 (Encrypted/Encoded File)?
T1027.013 is a MITRE ATT&CK technique named 'Encrypted/Encoded File'. It belongs to the Stealth tactic(s). Adversaries may encrypt or encode files to obfuscate strings, bytes, and other specific patterns to impede detection. Encrypting and/or encoding file content aims to conceal malicious artifacts within...
How can T1027.013 be detected?
Detection of T1027.013 (Encrypted/Encoded File) typically involves monitoring system logs, network traffic, and endpoint telemetry. Use SIEM rules, EDR solutions, and behavioral analytics to identify suspicious activity associated with this technique.
What mitigations exist for T1027.013?
There are 2 documented mitigations for T1027.013. Key mitigations include: Behavior Prevention on Endpoint, Antivirus/Antimalware.
Which threat groups use T1027.013?
Known threat groups using T1027.013 include: Elderwood, Kimsuky, menuPass, APT32, Storm-1811, TeamTNT, APT18, Sidewinder.