Log in Request a demo

Attack technique

Obfuscated Files or Information

Obfuscated Files or Information is a technique where an attacker hides the real content of a file, program or command by encrypting, encoding or packing it.

In short

Obfuscated Files or Information is a technique where an attacker hides the real content of a file, program or command by encrypting, encoding or packing it. The goal is to slip past security tools and make analysis harder. Tools look for known patterns, so changing how content looks can stop the patterns matching while it still runs.

Last updated 1 November 2026

Profile MapTechnique
  1. Reconnaissance
  2. Resource Development
  3. Initial Access
  4. Execution
  5. Persistence
  6. Privilege Escalation
  7. Stealth
  8. Defense Impairment
  9. Credential Access
  10. Discovery
  11. Lateral Movement
  12. Collection
  13. Command and Control
  14. Exfiltration
  15. Impact

Stealth · Step 7 Of 15 In The Attack Chain

  1. MITRE IDT1027ATT&CK technique
  2. Detection7ways to spot itEncoded content in transit · Data sources MITRE lists
  3. Defences3ways to stop itReview fileless storage

How it works

Security tools often look for known patterns in files and commands. An attacker can change how that content looks so the patterns no longer match, while the content still works when it runs.

Common approaches include compressing or archiving a payload, encoding text so plain-language clues disappear, and splitting a file into harmless-looking parts that only become dangerous when put back together.

Commands can also be disguised, for example by using system settings and platform quirks so that the command line does not look like what it does. MITRE lists 18 sub-techniques under this technique, from T1027.001 Binary Padding to T1027.018 Invisible Unicode.

The table lists the sub-techniques as MITRE ATT&CK names them, with a short note on what each one hides.

ATT&CK ID Sub-technique What it hides
T1027.001 Binary Padding Junk data added to change how a file looks on disk.
T1027.002 Software Packing Code compressed or encrypted and unpacked only when it runs.
T1027.003 Steganography Data hidden inside images or other digital media.
T1027.004 Compile After Delivery Source code delivered uncompiled and built on the victim system.
T1027.005 Indicator Removal from Tools A detected tool edited to remove what gave it away.
T1027.006 HTML Smuggling Payloads assembled from data held inside a harmless-looking HTML file.
T1027.007 Dynamic API Resolution API function names hidden and resolved only at run time.
T1027.008 Stripped Payloads Symbols, strings and other readable information removed.
T1027.009 Embedded Payloads Payloads tucked inside otherwise harmless files.
T1027.010 Command Obfuscation Command-line strings and patterns disguised.
T1027.011 Fileless Storage Data kept outside the normal file system, such as in the Registry.
T1027.012 LNK Icon Smuggling Download commands hidden in shortcut (LNK) files.
T1027.013 Encrypted/Encoded File File content encrypted or encoded to hide strings and bytes.
T1027.014 Polymorphic Code Code that keeps changing its own form to avoid detection.
T1027.015 Compression Payloads packed into formats such as ZIP, gzip, 7z or RAR.
T1027.016 Junk Code Insertion Code that does nothing, added to mask what the malware does.
T1027.017 SVG Smuggling Payloads hidden inside harmless-looking SVG files.
T1027.018 Invisible Unicode Non-printing characters used to conceal content.

Threat groups and malware we profile, by sub-technique

We matched the MITRE ATT&CK procedure examples (Enterprise version 19.2) against the threat group and malware profiles in our library. Each line below names the profiles we publish that MITRE lists as using that technique. The link in each line goes to the MITRE page with the procedure examples, which is the source for the line. The T1027 line holds profiles that MITRE ties to the parent technique itself.

57 of our profiles appear above: 31 threat groups and 26 malware families. Kimsuky has the widest spread, with MITRE listing it under nine of the lines, and Emotet follows with five. T1027.013 Encrypted/Encoded File holds the most of our profiles (28), then T1027.002 Software Packing (13) and T1027.010 Command Obfuscation (12).

MITRE lists no profile of ours under T1027.008 Stripped Payloads, T1027.014 Polymorphic Code, T1027.017 SVG Smuggling.

A real example

  • MITRE ATT&CK lists Action RAT as able to hold its commands, strings and domains Base64 encoded inside the payload.
  • MITRE ATT&CK lists ADVSTORESHELL as encrypting most of its strings with an XOR-based algorithm, with some also encrypted with 3DES and reversed.
  • MITRE ATT&CK lists Agent Tesla as having obfuscated code and using the Rijndael algorithm to encrypt strings.
  • MITRE ATT&CK lists Anchor as obfuscating its code with stack strings and string encryption.
  • MITRE ATT&CK lists AppleSeed as able to Base64 encode its payload and custom encrypt its API calls.

How to detect

  1. Encoded or packed files after script activity

    Link script runs or odd parent processes to the creation of encoded, compressed or encrypted files, especially with unusual command line syntax. On Windows, MITRE's analytic uses process creation (Security event 4688 or Sysmon event 1) and file creation (Sysmon event 11). Tune the entropy threshold, the time window and the list of suspicious parent processes to your environment.

  2. Use of encoding and archive tools

    Watch for encoding, compression and encryption tools used in scripts, particularly after files have been gathered or listed.

  3. Encoded content in transit

    Look for encoded or high-entropy files moving over web, file transfer or custom protocols during lateral movement or data theft. Tune the entropy threshold, because harmless compressed data can also look high-entropy.

  4. Linux and macOS: archive and encoding tools

    On Linux, look for gzip, base64, tar or openssl used in scripts after files are staged or the system is enumerated. MITRE points to auditd records of program runs and file writes, and to shell history. On macOS, watch zip, openssl and base64 use tied to user scripts, and encoded payloads written under /Users or /Volumes. MITRE names the unified log and osquery file events.

  5. ESXi: encoded payloads in datastores

    On ESXi hosts, look for Base64 encoded PowerCLI or other payloads staged through datastore uploads or shell access. MITRE names the vmkernel datastore events and the hostd remote access and file upload calls.

  6. Alert on obfuscated scripts in Microsoft Defender

    Microsoft's attack surface reduction rule Block execution of potentially obfuscated scripts looks for suspicious properties in obfuscated scripts. Microsoft says it needs cloud-delivered protection and relies on AMSI, and that it supports PowerShell scripts. Use audit mode to see what it would block, then review the AsrObfuscatedScriptAudited events in advanced hunting.

  7. Data sources MITRE lists

    Command Execution, File Creation, File Metadata, File Modification, Network Traffic Content, OS API Execution, Process Creation

How to defend

  1. Use anti-malware with script scanning

    Anti-virus can quarantine suspicious files, and the Antimalware Scan Interface on current Windows versions helps inspect content after it has been unpacked.

  2. Turn on attack surface reduction

    Attack surface reduction rules on current Windows versions can block execution of payloads that look obfuscated.

  3. Review fileless storage

    Check places such as the Registry and the WMI repository from time to time for abnormal data.

Questions

What is Obfuscated Files or Information?

T1027 is when an attacker encrypts, encodes or packs a file, program or command to hide its real content. MITRE lists 18 sub-techniques under it.

How does obfuscation help attackers?

Security tools often look for known patterns. Changing how content looks means the patterns no longer match, while the content still works when it runs.

How can I detect obfuscated files?

Link script runs or odd parent processes to the creation of encoded, compressed or encrypted files. Watch encoding and archive tools used in scripts, and encoded files moving over web or file transfer protocols.

How do I defend against obfuscation?

Use anti-malware with script scanning, including the Antimalware Scan Interface on current Windows, turn on attack surface reduction rules, and check the Registry and WMI repository for abnormal data.

Which threat groups and malware use obfuscated files or information?

MITRE lists many. In our library, 31 threat group profiles and 26 malware profiles appear in the list by sub-technique above. Kimsuky is listed under nine lines, the most of any profile. The sub-techniques with the most profiles are T1027.013 Encrypted/Encoded File, T1027.002 Software Packing and T1027.010 Command Obfuscation.

In our research

  1. Turn a Threat Report Into ATT&CK Mappings and Sigma Rules With an AI Agent October 2026
  2. Volt Typhoon advisory AA24-038A: what CISA says October 2026
  3. ATT&CK groups by attributed origin: what is mapped October 2026
  4. ATT&CK techniques most used across threat groups October 2026
  5. Detection of Steganography Attacks May 2026
  6. Donex Ransomware Technical Analysis August 2024

Sources

  1. MITRE ATT&CK T1027: Obfuscated Files or Information MITRE
  2. MITRE ATT&CK Tactic TA0005: Stealth MITRE
  3. Attack surface reduction rules reference: Block execution of potentially obfuscated scripts Microsoft
  4. MITRE ATT&CK Detection Strategy DET0378: Behavioral Detection of Obfuscated Files or Information MITRE

Browse the threat library

Keep exploring

Knowledge Hub

Threat group

Andariel

Attributed by the US, UK and South Korean governments to North Korea's Reconnaissance General Bureau, Andariel is described in a July 2024 joint advisory as stealing defense, aerospace and nuclear secrets and funding that work with ransomware against US healthcare. MITRE ATT&CK describes it as a sub-set of Lazarus Group; the advisory does not use that term.

Read more

Threat group

APT18

APT18 (MITRE G0026) is described by MITRE ATT&CK as a threat group active since at least 2009, with targets in technology, manufacturing, government and medical sectors. A US health sector briefing (HHS HC3, 2020) lists suspected attribution to China; no advisory, indictment or named sponsor was found.

Read more