Skip to content
Sign In
Learn

T1027

Obfuscated Files or Information

What it is

Attackers hide what their files and commands contain by encoding, encrypting, compressing or scrambling them, so that filters, scanners and analysts can't read them at a glance. It is a broad technique with many sub-techniques, one for each way of hiding. Obfuscation rarely does harm by itself, but it shows that someone wanted their activity to go unread, which makes it a useful lead.

How adversaries use it

The attacker encodes a script or command before running it, packs a program so its contents are scrambled on disk, splits strings into pieces that are joined at run time, or hides data inside another file. The host decodes it just before use, often with a built-in tool. Command lines that carry long blocks of encoded text, or that decode something and pass it straight to an interpreter, are the most visible sign.

Detect it in Elastic

Data source: Windows and Linux process creation events

Key fields

event.code: 1 (Sysmon) or 4688 (Windows Security) on Windows; event.action: executed (Auditbeat) or exec (Elastic Defend) on Linux process.command_line (Windows) or process.args (Linux): the command, including any encoded text or decoding step process.name: the program that ran process.parent.name: what started it user.name: the account it ran as host.name, @timestamp

Example event

{
  "host": {
    "name": "srv-237.corp.example"
  },
  "user": {
    "name": "m.castell"
  },
  "event": {
    "action": "exec"
  },
  "process": {
    "args": [
      "base64",
      "-d",
      "/dev/shm/.q4blob"
    ],
    "parent": {
      "executable": "/bin/sh"
    },
    "executable": "/usr/bin/base64"
  },
  "@timestamp": "2026-06-16T13:04:52.371Z"
}

Prebuilt Elastic rule: Unusual Base64 Encoding/Decoding Activity

Hunt guidance

Start with decoding steps run from the command line: process.name: "base64" and process.args: "-d" on Linux, and command lines that call a built-in tool to decode a file on Windows. Then look for unusually long command lines, which often carry encoded text. Look for decoded output passed straight to a shell or interpreter, encoded text started by a document or script host, and decoding in folders anyone can write to. The prebuilt rule named on this page reads only Elastic Defend data from Linux hosts and flags only decoding commands that are rare on a host, so on Windows, and with Auditbeat data, this hunt is the detection.

Ruling out legitimate activity

Installers, management agents and developers encode data for ordinary reasons, and some management tools send every command encoded. Check whether the parent and account belong to a known tool, decode a sample to see what it does, and compare with what the host normally runs. Encoded text that turns out to download or start something new is the case to chase.

Telemetry needed

The log events that help detect this technique, from the Telemetry reference: which log source to collect, which event in it, and how to enable each one.

References

Practice it

No range covers this technique yet; the write-up above landed first. Ranges are added continuously; the ones live today are on the training ladder.