| name | T1140_deobfuscatedecode-files-or-information |
| description | Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. |
| category | configuration |
| version | 18.1 |
| author | cyberstrike-official |
| tags | ["mitre-attack","enterprise","t1140","defense-evasion","esxi","linux","macos","windows"] |
| technique_id | T1140 |
| tactic | defense-evasion |
| all_tactics | ["defense-evasion"] |
| platforms | ["ESXi","Linux","macOS","Windows"] |
| mitre_url | https://attack.mitre.org/techniques/T1140 |
| tech_stack | ["esxi","linux","macos","windows"] |
| cwe_ids | ["CWE-693"] |
| chains_with | [] |
| prerequisites | [] |
| severity_boost | {} |
T1140 Deobfuscate/Decode Files or Information
High-Level Description
Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
One such example is the use of certutil to decode a remote access tool portable executable file that has been hidden inside a certificate file. Another example is using the Windows copy /b or type command to reassemble binary fragments into a malicious payload.
Sometimes a user's action may be required to open it for deobfuscation or decryption as part of User Execution. The user may also be required to input a password to open a password protected compressed/encrypted file that was provided by the adversary.
Kill Chain Phase
Platforms: ESXi, Linux, macOS, Windows
What to Check
How to Test
Atomic Red Team Tests
The following tests are from Atomic Red Team and provide actionable ways to test this technique:
Atomic Test 1: Deobfuscate/Decode Files Or Information
Encode/Decode executable
Upon execution a file named T1140_calc_decoded.exe will be placed in the temp folder
Supported Platforms: windows
certutil -encode #{executable} %temp%\T1140_calc.txt
certutil -decode %temp%\T1140_calc.txt %temp%\T1140_calc_decoded.exe
Atomic Test 2: Certutil Rename and Decode
Rename certutil and decode a file. This is in reference to latest research by FireEye here
