T1027Stealth
Obfuscated Files or Information
Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses. Payloads may be compressed, archived, or encrypted in order to avoid detection. These payloads may be used during…
CVEs5
In CISA KEVThe US Cybersecurity and Infrastructure Security Agency’s list of Known Exploited Vulnerabilities. A CVE is added when CISA has evidence that attackers are using it.5
Reports0
Detections
95 Sigma rules tagged T1027Obfuscated Files or InformationT102795 general rules
- Turla Group Commands May 2020criticaltest
- Potential Emotet Activityhighstable
- Base64 Encoded PowerShell Command Detectedhightest
- File Decoded From Base64/Hex Via Certutil.EXEhightest
- File In Suspicious Location Encoded To Base64 Via Certutil.EXEhightest
- Invoke-Obfuscation CLIP+ Launcherhightest
- Invoke-Obfuscation CLIP+ Launcher - PowerShellhightest
- Invoke-Obfuscation CLIP+ Launcher - PowerShell Modulehightest
Sigma rules © SigmaHQ, Detection Rule License 1.1; linked, not reproduced.
CVEs linked to Obfuscated Files or Information
5 CVEs, by priority. Each link shows its badge.- CVE-2021-40539Zoho ManageEngine ADSelfService Plus Authentication Bypass VulnerabilityZoho · ManageEngineKEVRansomwarePublic exploitCritical · 9.8T1190Exploit Public-Facing ApplicationT1047Windows Management Instrumentation+11 more · 1 reportMITRE CTID mapping of the KEV entry · follow-on activity99.0%Top 0.07%83.7priority
- CVE-2021-40449Microsoft Windows Win32k Privilege Escalation VulnerabilityMicrosoft · WindowsKEVRansomwarePublic exploitHigh · 7.8T1566PhishingT1059.003Windows Command Shell+6 moreMITRE CTID mapping of the KEV entry · follow-on activity81.9%Top 0.35%78.4priority
- CVE-2021-44077Zoho ManageEngine ServiceDesk Plus Remote Code Execution VulnerabilityZoho · ManageEngine ServiceDesk Plus (SDP) / SupportCenter PlusKEVPublic exploitCritical · 9.8T1190Exploit Public-Facing ApplicationT1047Windows Management Instrumentation+11 moreMITRE CTID mapping of the KEV entry · follow-on activity93.3%Top 0.16%69.8priority
- CVE-2022-24086Adobe Commerce and Magento Open Source Improper Input Validation VulnerabilityAdobe · Commerce and Magento Open SourceKEVPublic exploitCritical · 9.8T1190Exploit Public-Facing ApplicationT1027Obfuscated Files or Information+1 moreMITRE CTID mapping of the KEV entry · primary impact99.2%Top 0.07%69.8priority
- CVE-2010-2883Adobe Acrobat and Reader Stack-Based Buffer Overflow VulnerabilityAdobe · Acrobat and ReaderKEVPublic exploitEnd of lifeHigh · 7.3T1204.002Malicious FileT1059Command and Scripting Interpreter+1 more · 1 reportMITRE CTID mapping of the KEV entry · primary impact81.4%Top 0.36%56.9priority