Log in Request a demo

Attack technique

Obfuscated Files or Information

Obfuscated Files or Information is a technique where an attacker hides the real content of a file, program or command by encrypting, encoding or packing it.

In short

Obfuscated Files or Information is a technique where an attacker hides the real content of a file, program or command by encrypting, encoding or packing it. The goal is to slip past security tools and make analysis harder. Tools look for known patterns, so changing how content looks can stop the patterns matching while it still runs.

Last updated 8 October 2026

Profile MapTechnique
  1. Reconnaissance
  2. Resource Development
  3. Initial Access
  4. Execution
  5. Persistence
  6. Privilege Escalation
  7. Stealth
  8. Defense Impairment
  9. Credential Access
  10. Discovery
  11. Lateral Movement
  12. Collection
  13. Command and Control
  14. Exfiltration
  15. Impact

Stealth · Step 7 Of 15 In The Attack Chain

  1. MITRE IDT1027ATT&CK technique
  2. Detection4ways to spot itEncoded content in transit · Data sources MITRE lists
  3. Defences3ways to stop itReview fileless storage

How it works

Security tools often look for known patterns in files and commands. An attacker can change how that content looks so the patterns no longer match, while the content still works when it runs.

Common approaches include compressing or archiving a payload, encoding text so plain-language clues disappear, and splitting a file into harmless-looking parts that only become dangerous when put back together.

Commands can also be disguised, for example by using system settings and platform quirks so that the command line does not look like what it does. MITRE lists 18 sub-techniques under this technique. MITRE lists 18 sub-techniques, from T1027.001 Binary Padding to T1027.018 Invisible Unicode, including T1027.002 Software Packing, T1027.003 Steganography, T1027.006 HTML Smuggling, T1027.010 Command Obfuscation and T1027.015 Compression.

A real example

  • MITRE ATT&CK lists Action RAT as able to hold its commands, strings and domains Base64 encoded inside the payload.
  • MITRE ATT&CK lists ADVSTORESHELL as encrypting most of its strings with an XOR-based algorithm, with some also encrypted with 3DES and reversed.
  • MITRE ATT&CK lists Agent Tesla as having obfuscated code and using the Rijndael algorithm to encrypt strings.
  • MITRE ATT&CK lists Anchor as obfuscating its code with stack strings and string encryption.
  • MITRE ATT&CK lists AppleSeed as able to Base64 encode its payload and custom encrypt its API calls.

How to detect

  1. Encoded or packed files after script activity

    Link script runs or odd parent processes to the creation of encoded, compressed or encrypted files, especially with unusual command line syntax.

  2. Use of encoding and archive tools

    Watch for encoding, compression and encryption tools used in scripts, particularly after files have been gathered or listed.

  3. Encoded content in transit

    Look for encoded or high-entropy files moving over web, file transfer or custom protocols during lateral movement or data theft.

  4. Data sources MITRE lists

    Command Execution, File Creation, File Metadata, File Modification, Network Traffic Content, OS API Execution, Process Creation

How to defend

  1. Use anti-malware with script scanning

    Anti-virus can quarantine suspicious files, and the Antimalware Scan Interface on current Windows versions helps inspect content after it has been unpacked.

  2. Turn on attack surface reduction

    Attack surface reduction rules on current Windows versions can block execution of payloads that look obfuscated.

  3. Review fileless storage

    Check places such as the Registry and the WMI repository from time to time for abnormal data.

Questions

What is Obfuscated Files or Information?

T1027 is when an attacker encrypts, encodes or packs a file, program or command to hide its real content. MITRE lists 18 sub-techniques under it.

How does obfuscation help attackers?

Security tools often look for known patterns. Changing how content looks means the patterns no longer match, while the content still works when it runs.

How can I detect obfuscated files?

Link script runs or odd parent processes to the creation of encoded, compressed or encrypted files. Watch encoding and archive tools used in scripts, and encoded files moving over web or file transfer protocols.

How do I defend against obfuscation?

Use anti-malware with script scanning, including the Antimalware Scan Interface on current Windows, turn on attack surface reduction rules, and check the Registry and WMI repository for abnormal data.

In our research

  1. Volt Typhoon advisory AA24-038A: what CISA says October 2026
  2. ATT&CK groups by attributed origin: what is mapped October 2026
  3. ATT&CK techniques most used across threat groups October 2026
  4. Detection of Steganography Attacks May 2026
  5. Donex Ransomware Technical Analysis August 2024
  6. KageNoHitobito Ransomware Technical Analysis August 2024

Sources

  1. MITRE ATT&CK T1027: Obfuscated Files or Information MITRE
  2. MITRE ATT&CK Tactic TA0005: Stealth MITRE

Browse the threat library

Keep exploring

Knowledge Hub

Threat group

Andariel

Attributed by the US, UK and South Korean governments to North Korea's Reconnaissance General Bureau, Andariel is described in a July 2024 joint advisory as stealing defense, aerospace and nuclear secrets and funding that work with ransomware against US healthcare. MITRE ATT&CK describes it as a sub-set of Lazarus Group; the advisory does not use that term.

Read more

Threat group

APT18

APT18 (MITRE G0026) is described by MITRE ATT&CK as a threat group active since at least 2009, with targets in technology, manufacturing, government and medical sectors. A US health sector briefing (HHS HC3, 2020) lists suspected attribution to China; no advisory, indictment or named sponsor was found.

Read more