| Item |
Value |
| ID |
DET0378 |
| Version |
1.0 |
| Created |
21 October 2025 |
| Last Modified |
21 October 2025 |
Technique Detected: T1027 (Obfuscated Files or Information)
Analytics
Windows
AN1064
Correlates script execution or suspicious parent processes with creation or modification of encoded, compressed, or encrypted file formats (e.g., .zip, .7z, .enc) and abnormal command-line syntax or PowerShell obfuscation.
Log Sources
Mutable Elements
| Field |
Description |
| PayloadEntropyThreshold |
Tune entropy threshold to distinguish obfuscation from legitimate compression |
| TimeWindow |
Adjust correlation window between script execution and encoded file creation |
| SuspiciousParentProcessList |
Customize based on environment to include LOLBins or admin tools misused for obfuscation |
Linux
AN1065
Detects use of gzip, base64, tar, or openssl in scripts or commands that encode/encrypt files after file staging or system enumeration.
Log Sources
Mutable Elements
| Field |
Description |
| CommandRegex |
Customize for tools seen in environment (e.g., gzip, bzip2, xz) |
| SensitivePathList |
Specify file paths likely targeted for obfuscation (e.g., /etc/, /home/) |
macOS
AN1066
Monitors use of archive or encryption tools (zip, openssl) tied to user-scripted activity or binaries writing encoded payloads under /Users or /Volumes.
Log Sources
Mutable Elements
| Field |
Description |
| FilenameExtensionList |
Tunable to identify uncommon or encrypted file formats (e.g., .enc, .b64, .xz) |
| UserContext |
Tune to prioritize unexpected file access by service accounts |
Network Devices
AN1067
Identifies transfer of base64, uuencoded, or high-entropy files over HTTP, FTP, or custom protocols in lateral movement or exfiltration streams.
Log Sources
Mutable Elements
| Field |
Description |
| EntropyThreshold |
Adjust threshold to reduce false positives in compressed but benign data |
| ProtocolScope |
Refine by enabling inspection of specific exfil vectors (e.g., FTP, HTTP POST) |
ESXi
AN1068
Detects encoded PowerCLI or Base64-encoded payloads staged via datastore uploads or shell access (e.g., ESXi Shell or backdoored VIBs).
Log Sources
Mutable Elements
| Field |
Description |
| StagingLocation |
Tune based on observed adversary paths (e.g., /vmfs/volumes/…) |
| EncodedLengthThreshold |
Tune length of encoded payloads before triggering detection |