kevmap

Techniques › T1027 › T1027.008

T1027.008 Stripped Payloads

stealth — Linux, macOS, Network Devices, Windows · attack.mitre.org · JSON

1
MITRE detection strategy
4
analytics
0
Sigma rules tagged attack.t1027.008
0
KEV CVEs mapped here
<p>Adversaries may attempt to make a payload difficult to analyze by removing symbols, strings, and other human readable information. Scripts and executables may contain variables names and other strings that help developers document code functionality. Symbols are often created by an operating system’s linker when executable payloads are compiled. Reverse engineers use these symbols and strings to analyze code and to identify functionality in payloads.</p><p>Adversaries may use stripped payloads in order to make malware analysis more difficult. For example, compilers and other tools may provide features to remove or obfuscate strings and symbols. Adversaries have also used stripped payload formats, such as run-only AppleScripts, a compiled and stripped version of AppleScript, to evade detection and analysis. The lack of human-readable information may directly hinder detection and analysis of payloads.</p>

KEV CVEs mapped to this technique · CTID Mappings Explorer

None. No KEV entry in the public mapping names this technique. Given that 74.7% of KEV has no mapping at all, this says more about the mapping than about the technique.

Detection strategy · ATT&CK Enterprise v19.2

Sigma rules · SigmaHQ da9bb07d64, tag attack.t1027.008

No Sigma rule carries this tag. MITRE publishes a detection strategy above, so the behaviour is specified; what is missing is public detection content.

Rules tagged at the parent level (attack.t1027) 94

These target the parent technique, not this sub-technique specifically. Listed for completeness, not counted as coverage.

Password Protected ZIP File Opened mediumtest
Author: Florian Roth (Nextron Systems) · 2022-05-09 · logsource: product=windows service=security · 00ba9da1-b510-4f6b-b258-8d338836180f
Detects the extraction of password protected ZIP archives. See the filename variable for more details on which file has been opened.
Techniques: T1027
Invoke-Obfuscation Via Use MSHTA - PowerShell Module hightest
Author: Nikita Nazarov, oscd.community · 2020-10-08 (modified 2023-01-04) · logsource: product=windows category=ps_module · 07ad2ea8-6a55-4ac6-bf3e-91b8e59676eb
Detects Obfuscated Powershell via use MSHTA in Scripts
Techniques: T1027T1059.001
Invoke-Obfuscation VAR+ Launcher - PowerShell hightest
Author: Jonathan Cheong, oscd.community · 2020-10-15 (modified 2024-04-05) · logsource: product=windows category=ps_script · 0adfbc14-0ed1-11eb-adc1-0242ac120002
Detects Obfuscated use of Environment Variables to execute PowerShell
Techniques: T1027T1059.001
Suspicious Get-Variable.exe Creation hightest
Author: frack113 · 2022-04-23 · logsource: product=windows category=file_event · 0c3fac91-5627-46e8-a6a8-a0d7b9b8ae1b
Get-Variable is a valid PowerShell cmdlet WindowsApps is by default in the path where PowerShell is executed. So when the Get-Variable command is issued on PowerShell execution, the system first looks for the Get-Variable executable in the path and executes the malicious binary instead of looking for the PowerShell cmdlet.
Techniques: T1546T1027
Invoke-Obfuscation STDIN+ Launcher - Security hightest
Author: Jonathan Cheong, oscd.community · 2020-10-15 (modified 2022-11-29) · logsource: product=windows service=security · 0c718a5e-4284-4fb9-b4d9-b9a50b3a1974
Detects Obfuscated use of stdin to execute PowerShell
Techniques: T1027T1059.001
PUA - Potential PE Metadata Tamper Using Rcedit mediumtest
Author: Micah Babinski · 2022-12-11 (modified 2023-03-05) · logsource: product=windows category=process_creation · 0c92f2e6-f08f-4b73-9216-ecb0ca634689
Detects the use of rcedit to potentially alter executable PE metadata properties, which could conceal efforts to rename system utilities for defense evasion.
Techniques: T1036.003T1036T1027.005T1027
Potentially Suspicious Long Filename Pattern - Linux lowexperimental
Author: @kostastsale · 2025-11-22 · logsource: product=linux category=file_event · 11629c4d-0fe6-465b-be62-b39a1c442aad
Detects the creation of files with unusually long filenames (100 or more characters), which may indicate obfuscation techniques used by malware such as VShell. This is a hunting rule to identify potential threats that use long filenames to evade detection. Keep in mind that on a legitimate system, such long filenames can and are common. Run this detection in the context of threat hunting rather than alerting. Adjust the threshold of filename length as needed based on your environment.
Techniques: T1059.004T1027
Invoke-Obfuscation RUNDLL LAUNCHER - System mediumtest
Author: Timur Zinniatullin, oscd.community · 2020-10-18 (modified 2022-11-29) · logsource: product=windows service=system · 11b52f18-aaec-4d60-9143-5dd8cc4706b9
Detects Obfuscated Powershell via RUNDLL LAUNCHER
Techniques: T1027T1059.001
Potential Winnti Dropper Activity hightest
Author: Alexander Rausch · 2020-06-24 (modified 2023-01-05) · logsource: product=windows category=file_event · 130c9e58-28ac-4f83-8574-0a4cc913b97e
Detects files dropped by Winnti as described in RedMimicry Winnti playbook
Techniques: T1027
Suspicious File Downloaded From Direct IP Via Certutil.EXE hightest
Author: Nasreddine Bencherchali (Nextron Systems) · 2023-02-15 (modified 2025-12-01) · logsource: product=windows category=process_creation · 13e6fe51-d478-4c7e-b0f2-6da9b400a829
Detects the execution of certutil with certain flags that allow the utility to download files from direct IPs.
Techniques: T1027T1105
Invoke-Obfuscation VAR++ LAUNCHER OBFUSCATION - System hightest
Author: Timur Zinniatullin, oscd.community · 2020-10-13 (modified 2022-11-29) · logsource: product=windows service=system · 14bcba49-a428-42d9-b943-e2ce0f0f7ae6
Detects Obfuscated Powershell via VAR++ LAUNCHER
Techniques: T1027T1059.001
Invoke-Obfuscation COMPRESS OBFUSCATION - System mediumtest
Author: Timur Zinniatullin, oscd.community · 2020-10-18 (modified 2022-11-29) · logsource: product=windows service=system · 175997c5-803c-4b08-8bb0-70b099f47595
Detects Obfuscated Powershell via COMPRESS OBFUSCATION
Techniques: T1027T1059.001
Suspicious Filename with Embedded Base64 Commands highexperimental
Author: @kostastsale · 2025-11-22 · logsource: product=linux category=file_event · 179b3686-6271-4d87-807d-17d843a8af73
Detects files with specially crafted filenames that embed Base64-encoded bash payloads designed to execute when processed by shell scripts. These filenames exploit shell interpretation quirks to trigger hidden commands, a technique observed in VShell malware campaigns.
Techniques: T1059.004T1027
PowerShell Base64 Encoded WMI Classes hightest
Author: Christian Burkard (Nextron Systems), Nasreddine Bencherchali (Nextron Systems) · 2023-01-30 · logsource: product=windows category=process_creation · 1816994b-42e1-4fb1-afd2-134d88184f71
Detects calls to base64 encoded WMI class such as "Win32_ShadowCopy", "Win32_ScheduledJob", etc.
Techniques: T1059.001T1027
Suspicious Download Via Certutil.EXE mediumtest
Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community, Nasreddine Bencherchali (Nextron Systems) · 2023-02-15 (modified 2025-12-01) · logsource: product=windows category=process_creation · 19b08b1c-861d-4e75-a1ef-ea0c1baf202b
Detects the execution of certutil with certain flags that allow the utility to download files.
Techniques: T1027T1105
Invoke-Obfuscation Via Use Clip - Security hightest
Author: Nikita Nazarov, oscd.community · 2020-10-09 (modified 2022-11-29) · logsource: product=windows service=security · 1a0a2ff1-611b-4dac-8216-8a7b47c618a6
Detects Obfuscated Powershell via use Clip.exe in Scripts
Techniques: T1027T1059.001
Ping Hex IP hightest
Author: Florian Roth (Nextron Systems) · 2018-03-23 (modified 2025-10-17) · logsource: product=windows category=process_creation · 1a0d4aba-7668-4365-9ce4-6d79ab088dfd
Detects a ping command that uses a hex encoded IP address
Techniques: T1140T1027
Invoke-Obfuscation Obfuscated IEX Invocation - PowerShell hightest
Author: Daniel Bohannon (@Mandiant/@FireEye), oscd.community · 2019-11-08 (modified 2022-12-31) · logsource: product=windows category=ps_script · 1b9dc62e-6e9e-42a3-8990-94d7a10007f7
Detects all variations of obfuscated powershell IEX invocation code generated by Invoke-Obfuscation framework from the following code block \u2014
Techniques: T1027T1059.001
Operation Wocao Activity hightest
Author: Florian Roth (Nextron Systems), frack113 · 2019-12-20 (modified 2022-10-09) · logsource: product=windows category=process_creation · 1cfac73c-be78-4f9a-9b08-5bde0c3953ab
Detects activity mentioned in Operation Wocao report
Techniques: T1012T1036.004T1027T1053.005T1059.001
Invoke-Obfuscation COMPRESS OBFUSCATION - PowerShell mediumtest
Author: Timur Zinniatullin, oscd.community · 2020-10-18 (modified 2022-11-29) · logsource: product=windows category=ps_script · 20e5497e-331c-4cd5-8d36-935f6e2a9a07
Detects Obfuscated Powershell via COMPRESS OBFUSCATION
Techniques: T1027T1059.001
Suspicious SYSTEM User Process Creation hightest
Author: Florian Roth (Nextron Systems), David ANDRE (additional keywords) · 2021-12-20 (modified 2025-10-19) · logsource: product=windows category=process_creation · 2617e7ed-adb7-40ba-b0f3-8f9945fe6c09
Detects a suspicious process creation as SYSTEM user (suspicious program or command line parameter)
Techniques: T1134T1003T1027
Invoke-Obfuscation VAR+ Launcher hightest
Author: Jonathan Cheong, oscd.community · 2020-10-15 (modified 2024-04-15) · logsource: product=windows category=process_creation · 27aec9c9-dbb0-4939-8422-1742242471d0
Detects Obfuscated use of Environment Variables to execute PowerShell
Techniques: T1027T1059.001
Invoke-Obfuscation Obfuscated IEX Invocation - PowerShell Module hightest
Author: Daniel Bohannon (@Mandiant/@FireEye), oscd.community · 2019-11-08 (modified 2022-12-31) · logsource: product=windows category=ps_module · 2f211361-7dce-442d-b78a-c04039677378
Detects all variations of obfuscated powershell IEX invocation code generated by Invoke-Obfuscation framework from the code block cited in the reference section below
Techniques: T1027T1059.001
Certificate Exported Via Certutil.EXE mediumtest
Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community, Nasreddine Bencherchali (Nextron Systems) · 2023-02-15 (modified 2024-03-05) · logsource: product=windows category=process_creation · 3ffd6f51-e6c1-47b7-94b4-c1e61d4117c5
Detects the execution of the certutil with the "exportPFX" flag which allows the utility to export certificates.
Techniques: T1027
Suspicious File Downloaded From File-Sharing Website Via Certutil.EXE hightest
Author: Nasreddine Bencherchali (Nextron Systems) · 2023-02-15 (modified 2026-03-29) · logsource: product=windows category=process_creation · 42a5f1e7-9603-4f6d-97ae-3f37d130d794
Detects the execution of certutil with certain flags that allow the utility to download files from file-sharing websites.
Techniques: T1027T1105
Invoke-Obfuscation Via Stdin - System hightest
Author: Nikita Nazarov, oscd.community · 2020-10-12 (modified 2022-11-29) · logsource: product=windows service=system · 487c7524-f892-4054-b263-8a0ace63fc25
Detects Obfuscated Powershell via Stdin in Scripts
Techniques: T1027T1059.001
Invoke-Obfuscation Obfuscated IEX Invocation hightest
Author: Daniel Bohannon (@Mandiant/@FireEye), oscd.community · 2019-11-08 (modified 2026-03-16) · logsource: product=windows category=process_creation · 4bf943c6-5146-4273-98dd-e958fd1e3abf
Detects all variations of obfuscated powershell IEX invocation code generated by Invoke-Obfuscation framework from the following code block
Techniques: T1027T1059.001
Invoke-Obfuscation VAR++ LAUNCHER OBFUSCATION - Security hightest
Author: Timur Zinniatullin, oscd.community · 2020-10-13 (modified 2022-11-29) · logsource: product=windows service=security · 4c54ba8f-73d2-4d40-8890-d9cf1dca3d30
Detects Obfuscated Powershell via VAR++ LAUNCHER
Techniques: T1027T1059.001
Invoke-Obfuscation CLIP+ Launcher - Security hightest
Author: Jonathan Cheong, oscd.community · 2020-10-13 (modified 2022-11-27) · logsource: product=windows service=security · 4edf51e1-cb83-4e1a-bc39-800e396068e3
Detects Obfuscated use of Clip.exe to execute PowerShell
Techniques: T1027T1059.001
Invoke-Obfuscation Obfuscated IEX Invocation - System hightest
Author: Daniel Bohannon (@Mandiant/@FireEye), oscd.community · 2019-11-08 (modified 2022-11-27) · logsource: product=windows service=system · 51aa9387-1c53-4153-91cc-d73c59ae1ca9
Detects all variations of obfuscated powershell IEX invocation code generated by Invoke-Obfuscation framework from the code block linked in the references
Techniques: T1027
Password Protected ZIP File Opened (Suspicious Filenames) hightest
Author: Florian Roth (Nextron Systems) · 2022-05-09 · logsource: product=windows service=security · 54f0434b-726f-48a1-b2aa-067df14516e4
Detects the extraction of password protected ZIP archives with suspicious file names. See the filename variable for more details on which file has been opened.
Techniques: T1027T1105T1036
Password Protected ZIP File Opened (Email Attachment) hightest
Author: Florian Roth (Nextron Systems) · 2022-05-09 · logsource: product=windows service=security · 571498c8-908e-40b4-910b-d2369159a3da
Detects the extraction of password protected ZIP archives. See the filename variable for more details on which file has been opened.
Techniques: T1027T1566.001
Potential CommandLine Obfuscation Using Unicode Characters From Suspicious Image hightest
Author: frack113, Florian Roth (Nextron Systems), Josh Nickels · 2024-09-02 (modified 2025-05-30) · logsource: product=windows category=process_creation · 584bca0f-3608-4402-80fd-4075ff6072e3
Detects potential commandline obfuscation using unicode characters. Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit.
Techniques: T1027
PowerShell Base64 Encoded Reflective Assembly Load hightest
Author: Christian Burkard (Nextron Systems), pH-T (Nextron Systems) · 2022-03-01 (modified 2023-01-30) · logsource: product=windows category=process_creation · 62b7ccc9-23b4-471e-aa15-6da3663c4d59
Detects base64 encoded .NET reflective loading of Assembly
Techniques: T1059.001T1027T1620
PowerShell Base64 Encoded Invoke Keyword hightest
Author: pH-T (Nextron Systems), Harjot Singh, @cyb3rjy0t · 2022-05-20 (modified 2023-04-06) · logsource: product=windows category=process_creation · 6385697e-9f1b-40bd-8817-f4a91f40508e
Detects UTF-8 and UTF-16 Base64 encoded powershell 'Invoke-' calls
Techniques: T1059.001T1027
Invoke-Obfuscation Via Use Clip - System hightest
Author: Nikita Nazarov, oscd.community · 2020-10-09 (modified 2022-11-29) · logsource: product=windows service=system · 63e3365d-4824-42d8-8b82-e56810fefa0c
Detects Obfuscated Powershell via use Clip.exe in Scripts
Techniques: T1027T1059.001
Invoke-Obfuscation Via Use Rundll32 - System hightest
Author: Nikita Nazarov, oscd.community · 2020-10-09 (modified 2022-11-29) · logsource: product=windows service=system · 641a4bfb-c017-44f7-800c-2aee0184ce9b
Detects Obfuscated Powershell via use Rundll32 in Scripts
Techniques: T1027T1059.001
Invoke-Obfuscation VAR+ Launcher - PowerShell Module hightest
Author: Jonathan Cheong, oscd.community · 2020-10-15 (modified 2024-04-05) · logsource: product=windows category=ps_module · 6bfb8fa7-b2e7-4f6c-8d9d-824e5d06ea9e
Detects Obfuscated use of Environment Variables to execute PowerShell
Techniques: T1027T1059.001
Invoke-Obfuscation STDIN+ Launcher hightest
Author: Jonathan Cheong, oscd.community · 2020-10-15 (modified 2024-04-15) · logsource: product=windows category=process_creation · 6c96fc76-0eb1-11eb-adc1-0242ac120002
Detects Obfuscated use of stdin to execute PowerShell
Techniques: T1027T1059.001
Invoke-Obfuscation COMPRESS OBFUSCATION - PowerShell Module mediumtest
Author: Timur Zinniatullin, oscd.community · 2020-10-18 (modified 2022-11-29) · logsource: product=windows category=ps_module · 7034cbbb-cc55-4dc2-8dad-36c0b942e8f1
Detects Obfuscated Powershell via COMPRESS OBFUSCATION
Techniques: T1027T1059.001
Decode Base64 Encoded Text -MacOs lowtest
Author: Daniil Yugoslavskiy, oscd.community · 2020-10-19 (modified 2022-11-26) · logsource: product=macos category=process_creation · 719c22d7-c11a-4f2c-93a6-2cfdd5412f68
Detects usage of base64 utility to decode arbitrary base64-encoded text
Techniques: T1027
Invoke-Obfuscation STDIN+ Launcher - System hightest
Author: Jonathan Cheong, oscd.community · 2020-10-15 (modified 2022-11-29) · logsource: product=windows service=system · 72862bf2-0eb1-11eb-adc1-0242ac120002
Detects Obfuscated use of stdin to execute PowerShell
Techniques: T1027T1059.001
Invoke-Obfuscation CLIP+ Launcher - PowerShell hightest
Author: Jonathan Cheong, oscd.community · 2020-10-13 (modified 2024-04-05) · logsource: product=windows category=ps_script · 73e67340-0d25-11eb-adc1-0242ac120002
Detects Obfuscated use of Clip.exe to execute PowerShell
Techniques: T1027T1059.001
ConvertTo-SecureString Cmdlet Usage Via CommandLine mediumtest
Author: Teymur Kheirkhabarov (idea), Vasiliy Burov (rule), oscd.community, Tim Shelton · 2020-10-11 (modified 2023-02-01) · logsource: product=windows category=process_creation · 74403157-20f5-415d-89a7-c505779585cf
Detects usage of the "ConvertTo-SecureString" cmdlet via the commandline. Which is fairly uncommon and could indicate potential suspicious activity
Techniques: T1027T1059.001
Operation Wocao Activity - Security hightest
Author: Florian Roth (Nextron Systems), frack113 · 2019-12-20 (modified 2022-11-27) · logsource: product=windows service=security · 74ad4314-482e-4c3e-b237-3f7ed3b9ca8d
Detects activity mentioned in Operation Wocao report
Techniques: T1012T1036.004T1027T1053.005T1059.001
Invoke-Obfuscation STDIN+ Launcher - Powershell hightest
Author: Jonathan Cheong, oscd.community · 2020-10-15 (modified 2024-04-05) · logsource: product=windows category=ps_script · 779c8c12-0eb1-11eb-adc1-0242ac120002
Detects Obfuscated use of stdin to execute PowerShell
Techniques: T1027T1059.001
Invoke-Obfuscation COMPRESS OBFUSCATION - Security mediumtest
Author: Timur Zinniatullin, oscd.community · 2020-10-18 (modified 2022-11-29) · logsource: product=windows service=security · 7a922f1b-2635-4d6c-91ef-af228b198ad3
Detects Obfuscated Powershell via COMPRESS OBFUSCATION
Techniques: T1027T1059.001
Invoke-Obfuscation Via Use MSHTA - System hightest
Author: Nikita Nazarov, oscd.community · 2020-10-09 (modified 2022-11-29) · logsource: product=windows service=system · 7e9c7999-0f9b-4d4a-a6ed-af6d553d4af4
Detects Obfuscated Powershell via use MSHTA in Scripts
Techniques: T1027T1059.001
Invoke-Obfuscation COMPRESS OBFUSCATION mediumtest
Author: Timur Zinniatullin, oscd.community · 2020-10-18 (modified 2022-12-29) · logsource: product=windows category=process_creation · 7eedcc9d-9fdb-4d94-9c54-474e8affc0c7
Detects Obfuscated Powershell via COMPRESS OBFUSCATION
Techniques: T1027T1059.001
Invoke-Obfuscation Via Stdin - Security hightest
Author: Nikita Nazarov, oscd.community · 2020-10-12 (modified 2022-11-29) · logsource: product=windows service=security · 80b708f3-d034-40e4-a6c8-d23b7a7db3d1
Detects Obfuscated Powershell via Stdin in Scripts
Techniques: T1027T1059.001
File In Suspicious Location Encoded To Base64 Via Certutil.EXE hightest
Author: Nasreddine Bencherchali (Nextron Systems) · 2023-05-15 (modified 2024-03-05) · logsource: product=windows category=process_creation · 82a6714f-4899-4f16-9c1e-9a333544d4c3
Detects the execution of certutil with the "encode" flag to encode a file to base64 where the files are located in potentially suspicious locations
Techniques: T1027
Invoke-Obfuscation Via Stdin - Powershell hightest
Author: Nikita Nazarov, oscd.community · 2020-10-12 (modified 2024-04-05) · logsource: product=windows category=ps_script · 86b896ba-ffa1-4fea-83e3-ee28a4c915c7
Detects Obfuscated Powershell via Stdin in Scripts
Techniques: T1027T1059.001
Invoke-Obfuscation Via Use Rundll32 - PowerShell Module hightest
Author: Nikita Nazarov, oscd.community · 2019-10-08 (modified 2022-11-29) · logsource: product=windows category=ps_module · 88a22f69-62f9-4b8a-aa00-6b0212f2f05a
Detects Obfuscated Powershell via use Rundll32 in Scripts
Techniques: T1027T1059.001
Invoke-Obfuscation VAR+ Launcher - System hightest
Author: Jonathan Cheong, oscd.community · 2020-10-15 (modified 2022-11-29) · logsource: product=windows service=system · 8ca7004b-e620-4ecb-870e-86129b5b8e75
Detects Obfuscated use of Environment Variables to execute PowerShell
Techniques: T1027T1059.001
Potential Suspicious Execution From GUID Like Folder Names lowtest
Author: Nasreddine Bencherchali (Nextron Systems) · 2022-09-01 (modified 2023-03-02) · logsource: product=windows category=process_creation · 90b63c33-2b97-4631-a011-ceb0f47b77c3
Detects potential suspicious execution of a GUID like folder name located in a suspicious location such as %TEMP% as seen being used in IcedID attacks. Use this rule to hunt for potentially suspicious activity stemming from uncommon folders.
Techniques: T1027
Potential PowerShell Obfuscation Using Alias Cmdlets lowtest
Author: frack113 · 2023-01-08 (modified 2025-10-22) · logsource: product=windows category=ps_script · 96cd126d-f970-49c4-848a-da3a09f55c55
Detects Set-Alias or New-Alias cmdlet usage. Which can be use as a mean to obfuscate PowerShell scripts
Techniques: T1027T1059.001
Invoke-Obfuscation STDIN+ Launcher - PowerShell Module hightest
Author: Jonathan Cheong, oscd.community · 2020-10-15 (modified 2024-04-05) · logsource: product=windows category=ps_module · 9ac8b09b-45de-4a07-9da1-0de8c09304a3
Detects Obfuscated use of stdin to execute PowerShell
Techniques: T1027T1059.001
Invoke-Obfuscation Via Use MSHTA - Security hightest
Author: Nikita Nazarov, oscd.community · 2020-10-09 (modified 2022-11-29) · logsource: product=windows service=security · 9b8d9203-4e0f-4cd9-bb06-4cc4ea6d0e9a
Detects Obfuscated Powershell via use MSHTA in Scripts
Techniques: T1027T1059.001
Suspicious Encoded And Obfuscated Reflection Assembly Load Function Call hightest
Author: pH-T (Nextron Systems) · 2022-03-01 (modified 2023-04-06) · logsource: product=windows category=process_creation · 9c0295ce-d60d-40bd-bd74-84673b7592b1
Detects suspicious base64 encoded and obfuscated "LOAD" keyword used in .NET "reflection.assembly"
Techniques: T1059.001T1027
Invoke-Obfuscation Via Stdin hightest
Author: Nikita Nazarov, oscd.community · 2020-10-12 (modified 2026-03-16) · logsource: product=windows category=process_creation · 9c14c9fa-1a63-4a64-8e57-d19280559490
Detects Obfuscated Powershell via Stdin in Scripts
Techniques: T1027T1059.001
Turla Group Commands May 2020 criticaltest
Author: Florian Roth (Nextron Systems) · 2020-05-26 (modified 2025-10-19) · logsource: product=windows category=process_creation · 9e2e51c5-c699-4794-ba5a-29f5da40ac0c
Detects commands used by Turla group as reported by ESET in May 2020
Techniques: T1059.001T1053.005T1027
Invoke-Obfuscation CLIP+ Launcher - PowerShell Module hightest
Author: Jonathan Cheong, oscd.community · 2020-10-13 (modified 2024-04-05) · logsource: product=windows category=ps_module · a136cde0-61ad-4a61-9b82-8dc490e60dd2
Detects Obfuscated use of Clip.exe to execute PowerShell
Techniques: T1027T1059.001
Invoke-Obfuscation RUNDLL LAUNCHER - PowerShell Module mediumtest
Author: Timur Zinniatullin, oscd.community · 2020-10-18 (modified 2022-11-29) · logsource: product=windows category=ps_module · a23791fe-8846-485a-b16b-ca691e1b03d4
Detects Obfuscated Powershell via RUNDLL LAUNCHER
Techniques: T1027T1059.001
Invoke-Obfuscation Via Use Rundll32 - PowerShell hightest
Author: Nikita Nazarov, oscd.community · 2019-10-08 (modified 2022-11-29) · logsource: product=windows category=ps_script · a5a30a6e-75ca-4233-8b8c-42e0f2037d3b
Detects Obfuscated Powershell via use Rundll32 in Scripts
Techniques: T1027T1059.001
Invoke-Obfuscation Via Use MSHTA hightest
Author: Nikita Nazarov, oscd.community · 2020-10-08 (modified 2022-03-08) · logsource: product=windows category=process_creation · ac20ae82-8758-4f38-958e-b44a3140ca88
Detects Obfuscated Powershell via use MSHTA in Scripts
Techniques: T1027T1059.001
Invoke-Obfuscation CLIP+ Launcher hightest
Author: Jonathan Cheong, oscd.community · 2020-10-13 (modified 2022-11-17) · logsource: product=windows category=process_creation · b222df08-0e07-11eb-adc1-0242ac120002
Detects Obfuscated use of Clip.exe to execute PowerShell
Techniques: T1027T1059.001
Potential PowerShell Obfuscation Via Reversed Commands hightest
Author: Teymur Kheirkhabarov (idea), Vasiliy Burov (rule), oscd.community, Tim Shelton · 2020-10-11 (modified 2023-05-31) · logsource: product=windows category=process_creation · b6b49cd1-34d6-4ead-b1bf-176e9edba9a4
Detects the presence of reversed PowerShell commands in the CommandLine. This is often used as a method of obfuscation by attackers
Techniques: T1027T1059.001
Suspicious XOR Encoded PowerShell Command mediumtest
Author: Sami Ruohonen, Harish Segar, Tim Shelton, Teymur Kheirkhabarov, Vasiliy Burov, oscd.community, Nasreddine Bencherchali · 2018-09-05 (modified 2023-01-30) · logsource: product=windows category=process_creation · bb780e0c-16cf-4383-8383-1e5471db6cf9
Detects presence of a potentially xor encoded powershell command
Techniques: T1059.001T1140T1027
Invoke-Obfuscation Via Stdin - PowerShell Module hightest
Author: Nikita Nazarov, oscd.community · 2020-10-12 (modified 2024-04-05) · logsource: product=windows category=ps_module · c72aca44-8d52-45ad-8f81-f96c4d3c755e
Detects Obfuscated Powershell via Stdin in Scripts
Techniques: T1027T1059.001
File Decoded From Base64/Hex Via Certutil.EXE hightest
Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community · 2023-02-15 (modified 2025-06-04) · logsource: product=windows category=process_creation · cc9cbe82-7bc0-4ef5-bc23-bbfb83947be7
Detects the execution of certutil with either the "decode" or "decodehex" flags to decode base64 or hex encoded files. This can be abused by attackers to decode an encoded payload before execution
Techniques: T1027
Invoke-Obfuscation Via Use Rundll32 - Security hightest
Author: Nikita Nazarov, oscd.community · 2020-10-09 (modified 2022-11-29) · logsource: product=windows service=security · cd0f7229-d16f-42de-8fe3-fba365fbcb3a
Detects Obfuscated Powershell via use Rundll32 in Scripts
Techniques: T1027T1059.001
Potential Encoded PowerShell Patterns In CommandLine lowtest
Author: Teymur Kheirkhabarov (idea), Vasiliy Burov (rule), oscd.community, Tim Shelton · 2020-10-11 (modified 2023-01-26) · logsource: product=windows category=process_creation · cdf05894-89e7-4ead-b2b0-0a5f97a90f2f
Detects specific combinations of encoding methods in PowerShell via the commandline
Techniques: T1027T1059.001
Potential Emotet Activity highstable
Author: Florian Roth (Nextron Systems) · 2019-09-30 (modified 2023-02-04) · logsource: product=windows category=process_creation · d02e8cf5-6099-48cf-9bfc-1eec2d0c7b18
Detects all Emotet like process executions that are not covered by the more generic rules
Techniques: T1059.001T1027
Potential PowerShell Command Line Obfuscation hightest
Author: Teymur Kheirkhabarov (idea), Vasiliy Burov (rule), oscd.community, Tim Shelton (fp) · 2020-10-15 (modified 2024-04-15) · logsource: product=windows category=process_creation · d7bcd677-645d-4691-a8d4-7a5602b780d1
Detects the PowerShell command lines with special characters
Techniques: T1027T1059.001
Invoke-Obfuscation Via Use Clip - Powershell hightest
Author: Nikita Nazarov, oscd.community · 2020-10-09 (modified 2024-04-15) · logsource: product=windows category=ps_script · db92dd33-a3ad-49cf-8c2c-608c3e30ace0
Detects Obfuscated Powershell via use Clip.exe in Scripts
Techniques: T1027T1059.001
Invoke-Obfuscation VAR+ Launcher - Security hightest
Author: Jonathan Cheong, oscd.community · 2020-10-15 (modified 2022-11-29) · logsource: product=windows service=security · dcf2db1f-f091-425b-a821-c05875b8925a
Detects Obfuscated use of Environment Variables to execute PowerShell
Techniques: T1027T1059.001
Potential CommandLine Obfuscation Using Unicode Characters mediumtest
Author: frack113, Florian Roth (Nextron Systems) · 2022-01-15 (modified 2024-09-05) · logsource: product=windows category=process_creation · e0552b19-5a83-4222-b141-b36184bb8d79
Detects potential CommandLine obfuscation using unicode characters. Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit.
Techniques: T1027
Invoke-Obfuscation Via Use Clip hightest
Author: Nikita Nazarov, oscd.community · 2020-10-09 (modified 2026-03-16) · logsource: product=windows category=process_creation · e1561947-b4e3-4a74-9bdd-83baed21bdb5
Detects Obfuscated Powershell via use Clip.exe in Scripts
Techniques: T1027T1059.001
Decode Base64 Encoded Text lowtest
Author: Daniil Yugoslavskiy, oscd.community · 2020-10-19 (modified 2021-11-27) · logsource: product=linux category=process_creation · e2072cab-8c9a-459b-b63c-40ae79e27031
Detects usage of base64 utility to decode arbitrary base64-encoded text
Techniques: T1027
Potential PowerShell Obfuscation Via WCHAR/CHAR hightest
Author: Florian Roth (Nextron Systems) · 2020-07-09 (modified 2025-03-03) · logsource: product=windows category=process_creation · e312efd0-35a1-407f-8439-b8d434b438a6
Detects suspicious encoded character syntax often used for defense evasion
Techniques: T1059.001T1027
Base64 Encoded PowerShell Command Detected hightest
Author: Florian Roth (Nextron Systems) · 2020-01-29 (modified 2023-01-26) · logsource: product=windows category=process_creation · e32d4572-9826-4738-b651-95fa63747e8a
Detects usage of the "FromBase64String" function in the commandline which is used to decode a base64 encoded string
Techniques: T1027T1140T1059.001
Invoke-Obfuscation VAR++ LAUNCHER OBFUSCATION - PowerShell hightest
Author: Timur Zinniatullin, oscd.community · 2020-10-13 (modified 2024-04-05) · logsource: product=windows category=ps_script · e54f5149-6ba3-49cf-b153-070d24679126
Detects Obfuscated Powershell via VAR++ LAUNCHER
Techniques: T1027T1059.001
Invoke-Obfuscation Via Use MSHTA - PowerShell hightest
Author: Nikita Nazarov, oscd.community · 2020-10-08 (modified 2022-11-29) · logsource: product=windows category=ps_script · e55a5195-4724-480e-a77e-3ebe64bd3759
Detects Obfuscated Powershell via use MSHTA in Scripts
Techniques: T1027T1059.001
File Encoded To Base64 Via Certutil.EXE mediumtest
Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community, Nasreddine Bencherchali (Nextron Systems) · 2019-02-24 (modified 2024-03-05) · logsource: product=windows category=process_creation · e62a9f0c-ca1e-46b2-85d5-a6da77f86d1a
Detects the execution of certutil with the "encode" flag to encode a file to base64. This can be abused by threat actors and attackers for data exfiltration
Techniques: T1027
Invoke-Obfuscation RUNDLL LAUNCHER - PowerShell mediumtest
Author: Timur Zinniatullin, oscd.community · 2020-10-18 (modified 2022-11-29) · logsource: product=windows category=ps_script · e6cb92b4-b470-4eb8-8a9d-d63e8583aae0
Detects Obfuscated Powershell via RUNDLL LAUNCHER
Techniques: T1027T1059.001
Potential PowerShell Obfuscation Using Character Join lowtest
Author: Nasreddine Bencherchali (Nextron Systems) · 2023-01-09 · logsource: product=windows category=ps_script · e8314f79-564d-4f79-bc13-fbc0bf2660d8
Detects specific techniques often seen used inside of PowerShell scripts to obfscuate Alias creation
Techniques: T1027T1059.001
Invoke-Obfuscation VAR++ LAUNCHER OBFUSCATION hightest
Author: Timur Zinniatullin, oscd.community · 2020-10-13 (modified 2022-11-16) · logsource: product=windows category=process_creation · e9f55347-2928-4c06-88e5-1a7f8169942e
Detects Obfuscated Powershell via VAR++ LAUNCHER
Techniques: T1027T1059.001
Suspicious File Encoded To Base64 Via Certutil.EXE hightest
Author: Nasreddine Bencherchali (Nextron Systems) · 2023-05-15 (modified 2024-03-05) · logsource: product=windows category=process_creation · ea0cdc3e-2239-4f26-a947-4e8f8224e464
Detects the execution of certutil with the "encode" flag to encode a file to base64 where the extensions of the file is suspicious
Techniques: T1027
Invoke-Obfuscation Via Use Clip - PowerShell Module hightest
Author: Nikita Nazarov, oscd.community · 2020-10-09 (modified 2024-04-05) · logsource: product=windows category=ps_module · ebdf49d8-b89c-46c9-8fdf-2c308406f6bd
Detects Obfuscated Powershell via use Clip.exe in Scripts
Techniques: T1027T1059.001
Invoke-Obfuscation RUNDLL LAUNCHER - Security mediumtest
Author: Timur Zinniatullin, oscd.community · 2020-10-18 (modified 2022-11-29) · logsource: product=windows service=security · f241cf1b-3a6b-4e1a-b4f9-133c00dd95ca
Detects Obfuscated Powershell via RUNDLL LAUNCHER
Techniques: T1027T1059.001
Invoke-Obfuscation VAR++ LAUNCHER OBFUSCATION - PowerShell Module hightest
Author: Timur Zinniatullin, oscd.community · 2020-10-13 (modified 2024-04-05) · logsource: product=windows category=ps_module · f3c89218-8c3d-4ba9-9974-f1d8e6a1b4a6
Detects Obfuscated Powershell via VAR++ LAUNCHER
Techniques: T1027T1059.001
Renamed AutoIt Execution hightest
Author: Florian Roth (Nextron Systems) · 2023-06-04 (modified 2024-11-23) · logsource: product=windows category=process_creation · f4264e47-f522-4c38-a420-04525d5b880f
Detects the execution of a renamed AutoIt2.exe or AutoIt3.exe. AutoIt is a scripting language and automation tool for Windows systems. While primarily used for legitimate automation tasks, it can be misused in cyber attacks. Attackers can leverage AutoIt to create and distribute malware, including keyloggers, spyware, and botnets. A renamed AutoIt executable is particularly suspicious.
Techniques: T1027
Invoke-Obfuscation CLIP+ Launcher - System hightest
Author: Jonathan Cheong, oscd.community · 2020-10-13 (modified 2023-02-20) · logsource: product=windows service=system · f7385ee2-0e0c-11eb-adc1-0242ac120002
Detects Obfuscated use of Clip.exe to execute PowerShell
Techniques: T1027T1059.001
Invoke-Obfuscation Obfuscated IEX Invocation - Security hightest
Author: Daniel Bohannon (@Mandiant/@FireEye), oscd.community · 2019-11-08 (modified 2022-11-27) · logsource: product=windows service=security · fd0f5778-d3cb-4c9a-9695-66759d04702a
Detects all variations of obfuscated powershell IEX invocation code generated by Invoke-Obfuscation framework from the code block linked in the references
Techniques: T1027