MITRE ATT&CKtechnique

T1406 Obfuscated Files or Information

Published 2017-10-25 Modified 2026-05-12 Official page ↗
Domain
mobile
Tactics
Defense Evasion
Platforms
Android, iOS
Version
3.1
Created
2017-10-25

Description

Adversaries may attempt to make a payload or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the device or in transit. This is common behavior that can be used across different platforms and the network to evade defenses. Payloads may be compressed, archived, or encrypted in order to avoid detection. These payloads may be used during Initial Access or later to mitigate detection. Portions of files can also be encoded to hide the plaintext strings that would otherwise help defenders with discovery. Payloads may also be split into separate, seemingly benign files that only reveal malicious functionality when reassembled.

Related

Tactic · MITRE ATT&CK (1)

  • TA0030 Defense Evasion tactic

Referenced by MITRE ATT&CK · subtechnique of (2)

Referenced by MITRE ATT&CK · uses (49)

  • S9040 NGate software (malware)
  • S9005 DocSwap software (malware)
  • S9004 Crocodilus software (malware)
  • S1231 GodFather software (malware)
  • S1214 Android/SpyAgent software (malware)
  • S1185 LightSpy software (malware)
  • C0033 C0033 campaign
  • S1195 SpyC23 software (malware)
  • S1094 BRATA software (malware)
  • S1095 AhRat software (malware)
  • S1067 FluBot software (malware)
  • S1061 AbstractEmu software (malware)
  • S1056 TianySpy software (malware)
  • S1054 Drinik software (malware)
  • S1055 SharkBot software (malware)
  • S0555 CHEMISTGAMES software (malware)
  • S0549 SilkBean software (malware)
  • S0550 DoubleAgent software (malware)
  • S0545 TERRACOTTA software (malware)
  • S0544 HenBox software (malware)
  • S0539 Red Alert 2.0 software (malware)
  • S0540 Asacub software (malware)
  • S0536 GPlayed software (malware)
  • S0529 CarbonSteal software (malware)
  • S0524 AndroidOS/MalLocker.B software (malware)
  • S0525 Android/AdDisplay.Ashas software (malware)
  • S0509 FakeSpy software (malware)
  • S0494 Zen software (malware)
  • S0489 WolfRAT software (malware)
  • S0485 Mandrake software (malware)
Show all 49 ›

References