MITRE ATT&CKsub-technique

T1027.010 Command Obfuscation

Published 2023-03-14 Modified 2026-05-12 Official page ↗
Domain
enterprise
Tactics
Stealth
Platforms
Linux, macOS, Windows
Version
2.0
Created
2023-03-14

Description

Adversaries may obfuscate content during command execution to impede detection. Command-line obfuscation is a method of making strings and patterns within commands and scripts more difficult to signature and analyze. This type of obfuscation can be included within commands executed by delivered payloads (e.g., Phishing and Drive-by Compromise) or interactively via Command and Scripting Interpreter. For example, adversaries may abuse syntax that utilizes various symbols and escape characters (such as spacing, `^`, `+`. `$`, and `%`) to make commands difficult to analyze while maintaining the same intended functionality. Many languages support built-in obfuscation in the form of base64 or URL encoding. Adversaries may also manually implement command obfuscation via string splitting (`“Wor”+“d.Application”`), order and casing of characters (`rev <<<'dwssap/cte/ tac'`), globing (`mkdir -p '/tmp/:&$NiA'`), as well as various tricks involving passing strings through tokens/environment variables/input streams. Adversaries may also use tricks such as directory traversals to obfuscate references to the binary being invoked by a command (`C:\voi\pcw\..\..\Windows\tei\qs\k\..\..\..\system32\erool\..\wbem\wg\je\..\..\wmic.exe shadowcopy delete`). Tools such as Invoke-Obfuscation and Invoke-DOSfucation have also been used to obfuscate commands.

Related

Subtechnique of · MITRE ATT&CK (1)

  • T1027 Obfuscated Files or Information technique

Tactic · MITRE ATT&CK (1)

Referenced by MITRE ATT&CK · mitigates (2)

  • M1040 Behavior Prevention on Endpoint mitigation
  • M1049 Antivirus/Antimalware mitigation

Referenced by MITRE ATT&CK · uses (74)

  • S9051 The Gentlemen Ransomware software (malware)
  • C0064 AI-Assisted Breach of Mexico's Government Infrastructure campaign
  • S9029 IronWind software (malware)
  • S9034 Tsundere Botnet software (malware)
  • S9014 PHASEJAM software (malware)
  • S1248 XORIndex Loader software (malware)
  • G1052 Contagious Interview group
  • C0058 SharePoint ToolShell Exploitation campaign
  • G1051 Medusa Group group
  • S1240 RedLine Stealer software (malware)
  • S1229 Havoc software (malware)
  • G1045 Salt Typhoon group
  • G1040 Play group
  • S1085 Sardonic software (malware)
  • S1081 BADHATCH software (malware)
  • C0021 C0021 campaign
  • C0018 C0018 campaign
  • C0014 Operation Wocao campaign
  • C0012 Operation CuckooBees campaign
  • C0001 Frankenstein campaign
  • S1022 IceApple software (malware)
  • S0685 PowerPunch software (malware)
  • G0143 Aquatic Panda group
  • S0673 DarkWatchman software (malware)
  • S0669 KOCTOPUS software (malware)
  • G0140 LazyScripter group
  • S0650 QakBot software (malware)
  • G0127 TA551 group
  • S0589 Sibot software (malware)
  • G0121 Sidewinder group
Show all 74 ›

Referenced by Compliance · mitigates (5)

  • CIS-13.7 Deploy a Host-Based Intrusion Prevention Solution CIS Safeguard v8.1
  • NIST-CM-6 Configuration Settings NIST 800-53 control
  • NIST-SI-10 Information Input Validation NIST 800-53 control
  • NIST-SI-3 Malicious Code Protection NIST 800-53 control
  • NIST-SI-4 System Monitoring NIST 800-53 control

References