Techniques › T1140

T1140 Deobfuscate/Decode Files or Information

stealth — ESXi, Linux, macOS, Windows · attack.mitre.org · JSON

KEV CVEs mapped to this technique · CTID Mappings Explorer

Detection strategy · ATT&CK Enterprise v19.2

• DET0275 Detect Adversary Deobfuscation or Decoding of Files and Payloads v1.0
  AN0767 Windows

  An adversary leverages built-in tools such as certutil.exe, powershell.exe, or copy.exe to decode, reassemble, or extract hidden malicious content from obfuscated containers or encoded formats. The decoding utility often spawns shortly after file staging or download and may be chained with script interpreters or further payload execution.

  WinEventLog:Sysmon EventCode=1 → DC0032 Process Creation

  WinEventLog:Sysmon EventCode=11 → DC0039 File Creation

  WinEventLog:Sysmon EventCode=10 → DC0035 Process Access

  Tunable: ToolName FileExtensionFilter CommandLineRegex TimeWindow
  AN0768 Linux

  The adversary uses native utilities like base64, gzip, tar, or openssl to decode, decompress, or decrypt files that were previously staged or downloaded. These tools may be chained with curl/wget and executed via bash/zsh, often to extract an embedded payload or reverse shell script.

  auditd:SYSCALL bash/zsh of base64, tar, gzip, or openssl immediately after file write → DC0064 Command Execution

  Tunable: ShellProcessName DecodeUtility ParentProcess ArgumentPattern
  AN0769 macOS

  The adversary invokes built-in scripting or decoding tools like base64, plutil, or AppleScript-based utilities to decode files embedded in staging artifacts. Decoding often occurs post-download or as part of post-exploitation payload deployment via zsh, python, or osascript.

  macos:unifiedlog base64 -d or osascript invoked on staged file → DC0064 Command Execution

  Tunable: DecodeInterpreter ExecutionContext UserContext

Sigma rules · SigmaHQ da9bb07d64, tag attack.t1140