T1027.010Stealth
Command Obfuscation
Adversaries may obfuscate content during command execution to impede detection. Command-line obfuscation is a method of making strings and patterns within commands and scripts more difficult to signature and analyze. This type of obfuscation can be included within commands executed by delivered payloads (e.g., Phishing and Drive-by Compromise) or interactively via Command and Scripting…
CVEs0
In CISA KEVThe US Cybersecurity and Infrastructure Security Agency’s list of Known Exploited Vulnerabilities. A CVE is added when CISA has evidence that attackers are using it.0
Reports0
Detections
11 Sigma rules tagged T1027.010Command ObfuscationT1027.01011 general rules
- Obfuscated PowerShell MSI Install via WindowsInstaller COMhighexperimental
- PowerShell Dynamic Module Invocation Via ExportedCommands Array Indexhighexperimental
- Python One-Liners with Base64 Decodinghighexperimental
- Python One-Liners with Base64 Decoding - Linuxhighexperimental
- Suspicious Explorer Process with Whitespace Padding - ClickFix/FileFixhighexperimental
- Suspicious Space Characters in RunMRU Registry Path - ClickFixhighexperimental
- Suspicious Space Characters in TypedPaths Registry Path - FileFixhighexperimental
- Invocation Of Crypto-Classes From The "Cryptography" PowerShell Namespacemediumtest
Sigma rules © SigmaHQ, Detection Rule License 1.1; linked, not reproduced.
CVEs linked to Command Obfuscation
0 CVEs, by priority. Each link shows its badge.No CVEs are linked to this technique yet.