T1027.010 Command Obfuscation

stealth — Linux, macOS, Windows · attack.mitre.org · JSON

MITRE detection strategy

analytics

Sigma rules tagged attack.t1027.010

KEV CVEs mapped here

Adversaries may obfuscate content during command execution to impede detection. Command-line obfuscation is a method of making strings and patterns within commands and scripts more difficult to signature and analyze. This type of obfuscation can be included within commands executed by delivered payloads (e.g., Phishing and Drive-by Compromise) or interactively via Command and Scripting Interpreter.For example, adversaries may abuse syntax that utilizes various symbols and escape characters (such as spacing, ^, +. $, and %) to make commands difficult to analyze while maintaining the same intended functionality. Many languages support built-in obfuscation in the form of base64 or URL encoding. Adversaries may also manually implement command obfuscation via string splitting (“Wor”+“d.Application”), order and casing of characters (rev <<<'dwssap/cte/ tac'), globing (mkdir -p '/tmp/:&$NiA'), as well as various tricks involving passing strings through tokens/environment variables/input streams.Adversaries may also use tricks such as directory traversals to obfuscate references to the binary being invoked by a command (C:\voi\pcw\..\..\Windows\tei\qs\k\..\..\..\system32\erool\..\wbem\wg\je\..\..\wmic.exe shadowcopy delete).Tools such as <code>Invoke-Obfuscation</code> and <code>Invoke-DOSfucation</code> have also been used to obfuscate commands.

KEV CVEs mapped to this technique · CTID Mappings Explorer

None. No KEV entry in the public mapping names this technique. Given that 74.7% of KEV has no mapping at all, this says more about the mapping than about the technique.

Detection strategy · ATT&CK Enterprise v19.2

DET0505 Detection Strategy for Command Obfuscation v1.0
AN1394 Windows
Detection of command-line activity exhibiting syntactic obfuscation patterns, such as excessive escape characters, base64 encoding, command concatenation, or outlier command length and entropy.

WinEventLog:Security EventCode=4688 → DC0032 Process Creation

Tunable: CommandLineEntropyThreshold SuspiciousCharacterCount TimeWindow

AN1395 Linux
Detection of shell commands that leverage encoded execution, command chaining, excessive piping, or unusual token patterns indicative of obfuscation.

auditd:SYSCALL execve → DC0032 Process Creation
linux:osquery process_events.command_line → DC0064 Command Execution

Tunable: CommandLineTokenCount EncodedExecRegex GlobPatternAnomalies

AN1396 macOS
Detection of obfuscated commands via shell, osascript, or AppleScript interpreters using unusual tokens, encoding, variable substitution, or runtime string reconstruction.

macos:unifiedlog process:spawn, process:exec → DC0064 Command Execution
macos:endpointsecurity ES_EVENT_TYPE_NOTIFY_EXEC → DC0032 Process Creation

Tunable: InterpreterParentFilter ScriptEntropyThreshold ArgumentLengthDeviation

Sigma rules · SigmaHQ da9bb07d64, tag `attack.t1027.010`

Registry Set With Crypto-Classes From The "Cryptography" PowerShell Namespace mediumtest

Author: Andreas Braathen (mnemonic.io) · 2023-12-01 · logsource: product=windows category=registry_set · 1c2a3268-3881-414a-80af-a5b313b14c0e

Detects the setting of a registry inside the "\Shell\Open\Command" value with PowerShell classes from the "System.Security.Cryptography" namespace. The PowerShell namespace "System.Security.Cryptography" provides classes for on-the-fly encryption and decryption. These can be used for example in decrypting malicious payload for defense evasion.

Suspicious Usage of For Loop with Recursive Directory Search in CMD mediumexperimental

Author: Joseliyo Sanchez, @Joseliyo_Jstnk · 2025-11-12 · logsource: product=windows category=process_creation · 2782fbd8-b662-4eb5-9962-5bfbfb671e7b

Detects suspicious usage of the cmd.exe 'for /f' loop combined with the 'tokens=' parameter and a recursive directory listing. This pattern may indicate an attempt to discover and execute system binaries dynamically, for example powershell, a technique sometimes used by attackers to evade detection. This behavior has been observed in various malicious lnk files.

Techniques: T1059.003 T1027.010

Suspicious Explorer Process with Whitespace Padding - ClickFix/FileFix highexperimental

Author: Swachchhanda Shrawan Poudel (Nextron Systems) · 2025-11-04 (modified 2025-11-26) · logsource: product=windows category=process_creation · 3ae9974a-eb09-4044-8e70-8980a50c12c8

Detects process creation with suspicious whitespace padding followed by a '#' character, which may indicate ClickFix or FileFix techniques used to conceal malicious commands from visual inspection. ClickFix and FileFix are social engineering attack techniques where adversaries distribute phishing documents or malicious links that deceive users into opening the Windows Run dialog box or File Explorer search bar. The victims are then instructed to paste commands from their clipboard, which contain extensive whitespace padding using various Unicode space characters to push the actual malicious command far to the right, effectively hiding it from immediate view.

Techniques: T1204.004 T1027.010

Potential Obfuscated Ordinal Call Via Rundll32 mediumtest

Author: Nasreddine Bencherchali (Nextron Systems), Swachchhanda Shrawan Poudel (Nextron Systems) · 2023-05-17 (modified 2025-02-23) · logsource: product=windows category=process_creation · 43fa5350-db63-4b8f-9a01-789a427074e1

Detects execution of "rundll32" with potential obfuscated ordinal calls

Techniques: T1027.010

Python One-Liners with Base64 Decoding highexperimental

Author: Hugh Ryan (HueCodes), Swachchhanda Shrawan Poudel (Nextron Systems) · 2026-03-09 · logsource: product=windows category=process_creation · 50a0aa3d-ab16-4594-a8aa-5145a6e6792b

Detects Python one-liners that use base64 decoding functions in command line executions. Malicious scripts or attackers often use python one-liners to decode and execute base64-encoded payloads, which is a common technique for obfuscation and evasion.

Techniques: T1059.006 T1027.010

Python One-Liners with Base64 Decoding - Linux highexperimental

Author: Hugh Ryan (HueCodes), Swachchhanda Shrawan Poudel (Nextron Systems) · 2026-03-09 · logsource: product=linux category=process_creation · 55e862a8-dd9c-4651-807a-f21fcad56716

Detects the use of Python's base64 decoding functions in command line executions on Linux systems. Malicious scripts often use python one-liners to decode and execute base64-encoded payloads, which is a common technique for obfuscation and evasion.

Techniques: T1059.006 T1027.010

Suspicious Space Characters in RunMRU Registry Path - ClickFix highexperimental

Author: Swachchhanda Shrawan Poudel (Nextron Systems) · 2025-11-04 · logsource: product=windows category=registry_set · 7a1b4c5e-8f3d-4b9a-7c2e-1f4a5b8c6d9e

Detects the occurrence of numerous space characters in RunMRU registry paths, which may indicate execution via phishing lures using clickfix techniques to hide malicious commands in the Windows Run dialog box from naked eyes.

Techniques: T1204.004 T1027.010

Obfuscated PowerShell MSI Install via WindowsInstaller COM highexperimental

Author: Meroujan Antonyan (vx3r) · 2025-05-27 · logsource: product=windows category=process_creation · 7b6a7418-3afc-11f0-aff4-000d3abf478c

Detects the execution of obfuscated PowerShell commands that attempt to install MSI packages via the Windows Installer COM object (`WindowsInstaller.Installer`). The technique involves manipulating strings to hide functionality, such as constructing class names using string insertion (e.g., 'indowsInstaller.Installer'.Insert(0,'W')) and correcting malformed URLs (e.g., converting 'htps://' to 'https://') at runtime. This behavior is commonly associated with malware loaders or droppers that aim to bypass static detection by hiding intent in runtime-generated strings and using legitimate tools for code execution. The use of `InstallProduct` and COM object creation, particularly combined with hidden window execution and suppressed UI, indicates an attempt to install software (likely malicious) without user interaction.

Techniques: T1027.010 T1218.007 T1059.001

Suspicious Space Characters in TypedPaths Registry Path - FileFix highexperimental

Author: Swachchhanda Shrawan Poudel (Nextron Systems) · 2025-11-04 · logsource: product=windows category=registry_set · 8f2a5c3d-9e4b-4a7c-8d1f-2e5a6b9c3d7e

Detects the occurrence of numerous space characters in TypedPaths registry paths, which may indicate execution via phishing lures using file-fix techniques to hide malicious commands.

Techniques: T1204.004 T1027.010

Invocation Of Crypto-Classes From The "Cryptography" PowerShell Namespace mediumtest

Author: Andreas Braathen (mnemonic.io) · 2023-12-01 · logsource: product=windows category=process_creation · ad856965-f44d-42a8-945e-bbf7bd03d05a

Detects the invocation of PowerShell commands with references to classes from the "System.Security.Cryptography" namespace. The PowerShell namespace "System.Security.Cryptography" provides classes for on-the-fly encryption and decryption. These can be used for example in decrypting malicious payload for defense evasion.

Techniques: T1059.001 T1027.010

Rules tagged at the parent level (attack.t1027) 94

These target the parent technique, not this sub-technique specifically. Listed for completeness, not counted as coverage.

Password Protected ZIP File Opened mediumtest

Author: Florian Roth (Nextron Systems) · 2022-05-09 · logsource: product=windows service=security · 00ba9da1-b510-4f6b-b258-8d338836180f

Detects the extraction of password protected ZIP archives. See the filename variable for more details on which file has been opened.

Techniques: T1027

Invoke-Obfuscation Via Use MSHTA - PowerShell Module hightest

Author: Nikita Nazarov, oscd.community · 2020-10-08 (modified 2023-01-04) · logsource: product=windows category=ps_module · 07ad2ea8-6a55-4ac6-bf3e-91b8e59676eb

Detects Obfuscated Powershell via use MSHTA in Scripts

T1027.010 Command Obfuscation

KEV CVEs mapped to this technique · CTID Mappings Explorer

Detection strategy · ATT&CK Enterprise v19.2

Sigma rules · SigmaHQ da9bb07d64, tag attack.t1027.010

Rules tagged at the parent level (attack.t1027) 94

Sigma rules · SigmaHQ da9bb07d64, tag `attack.t1027.010`