Obfuscation is the act of making code, files or data hard to read, discover or analyze. MITRE ATT&CK describes attackers making executables or files difficult to discover or analyze by encrypting, encoding or otherwise obfuscating their contents. It is used to hide malicious content from people and tools.
- Also Called3other namescode obfuscation · file obfuscation
- Related Terms3linked entriesMalware-as-a-service (MaaS) · Indicator of compromise (IoC)
What Is Obfuscation?
Obfuscation means changing something so that it is hard to understand while it still works. In security, MITRE ATT&CK describes the technique Obfuscated Files or Information (T1027). It says adversaries attempt to make an executable or file difficult to discover or analyze by encrypting, encoding or otherwise obfuscating its contents on the system or in transit. An executable is a file that a computer can run.
How Do Attackers Hide What a File Does?
MITRE’s wording gives the main methods. Encrypting turns content into unreadable data that needs a key. Encoding rewrites content in another format that looks different from the original. Both can apply to content stored on a system and to content moving across a network. Obfuscated content is meant to make a file or its purpose harder to find or study. A simple illustration: a script whose real instructions are stored in an encoded block and only turned back into readable form when it runs.
MITRE also describes related approaches:
- Compressing and encrypting payloads.
- Requiring the user to open a file or enter a password to decrypt an archive.
- Encoding only part of a file to hide plain text strings.
- Splitting a payload into harmless-looking files that reveal their purpose only when put back together.
It lists 18 sub-techniques, including Command Obfuscation, Software Packing, Steganography and HTML Smuggling.
Which ATT&CK Sub-Techniques Hide Content?
MITRE lists 18 sub-techniques under T1027. Six of them show how different the methods are.
| ATT&CK ID | Sub-technique | What it does |
|---|---|---|
| T1027.002 | Software Packing | Compresses or encrypts an executable, which changes its file signature. |
| T1027.003 | Steganography | Hides data in images, audio tracks, video clips or text files. |
| T1027.006 | HTML Smuggling | Hides payloads inside benign looking HTML files to pass content filters. |
| T1027.010 | Command Obfuscation | Makes strings and patterns in commands and scripts harder to signature. |
| T1027.011 | Fileless Storage | Keeps data outside files, for example in the Registry, event logs or WMI repository. |
| T1027.015 | Compression | Packs payloads into ZIP, gzip, 7z or RAR files. |
Several of these can be combined in one attack.
Why Does a Clean Scan Not Settle It?
Obfuscation can make a malicious file look harmless to a quick check, and it can slow down the people who analyze it. Defenders therefore cannot rely on reading a file’s contents alone. The technique is also used to avoid being found, so a clean result from a single tool does not always settle the question.
What Does MITRE Suggest for Defenders?
MITRE’s mitigation list for this technique includes the following.
- Anti-virus can be used to automatically detect and quarantine suspicious files.
- Review common fileless storage locations, such as the Registry, to identify abnormal and malicious data.
- On Windows 10 and later, enable Attack Surface Reduction rules to prevent execution of potentially obfuscated payloads.
For detection, MITRE focuses on linking suspicious script execution with the creation of encoded files. It also points to tools such as gzip, base64, tar and openssl that encode files after staging. It also points to base64, uuencoded or high-entropy file transfers over HTTP or FTP.
Is Obfuscation the Same as Encryption?
No. Encryption is one way to obfuscate. MITRE names encrypting and encoding side by side, and the phrase otherwise obfuscating shows there are other ways. Obfuscation only needs to make content hard to read or analyze, while encryption specifically needs a key to read it.
Is Obfuscation Always Malicious?
No. Obfuscation is a method, not a verdict. MITRE describes how adversaries use it, but the same idea can be applied to code for other reasons. A tool that finds obfuscated content should therefore lead to a closer look, not an automatic conclusion.
Related Pages in the Knowledge Hub
Also Called.
- Namecode obfuscation
- Namefile obfuscation
- Nameobfuscated files or information
Questions.
-
What is obfuscation in cybersecurity?
Obfuscation is the act of making code, files or data hard to read, discover or analyze. MITRE ATT&CK describes attackers doing this by encrypting, encoding or otherwise obfuscating the contents of an executable or file.
-
How does obfuscation work?
Content is encrypted or encoded so it looks different from the original, whether stored on a system or moving across a network. A script can hold its real instructions in an encoded block and decode them only when it runs.
-
Is obfuscation the same as encryption?
No. Encryption is one way to obfuscate, and it needs a key to read the content. Obfuscation only has to make content hard to read or analyze, so encoding and other methods count too.
-
How can defenders reduce the risk of obfuscated files?
MITRE suggests anti-virus to detect and quarantine suspicious files and, on Windows 10 and later, Attack Surface Reduction rules to block execution of potentially obfuscated payloads. Watching script execution that creates encoded files also helps.
Sources
- 1 Obfuscated Files or Information, Technique T1027 - Enterprise, MITRE ATT&CK
- 2 MITRE ATT&CK: T1027.013: adversaries may encrypt or encode file content to hide strings, bytes and other patterns and so impede detection, MITRE ATT&CK
- 3 MITRE ATT&CK: T1027.002 Software Packing, MITRE ATT&CK
- 4 MITRE ATT&CK: T1027.003 Steganography, MITRE ATT&CK
- 5 MITRE ATT&CK: T1027.006 HTML Smuggling, MITRE ATT&CK
- 6 MITRE ATT&CK: T1027.010 Command Obfuscation, MITRE ATT&CK
- 7 MITRE ATT&CK: T1027.011 Fileless Storage, MITRE ATT&CK
- 8 MITRE ATT&CK: T1027.015 Compression, MITRE ATT&CK
In Our Research
- 1 How a Fake Job Interview Led to the $6.34B Binance Attack, Step by Step November 2026
- 2 Storm-2603 ToolShell Intrusion: The Fileless Chain Inside w3wp.exe, Step by Step November 2026
- 3 XCPE: How a Preloaded Android TV Backdoor Grew Into a 1.3 Million Device Botnet November 2026
- 4 BlackX UEFI Bootkit Step by Step: Why Patched Windows Still Fell October 2026
- 5 How to Defend Against PHP2Shell October 2026
- 6 Malicious Document Analysis for SOC Analysts May 2026