t1027-013-encryptedencoded-file

name	T1027.013_encryptedencoded-file
description	Adversaries may encrypt or encode files to obfuscate strings, bytes, and other specific patterns to impede detection.
category	configuration
version	18.1
author	cyberstrike-official
tags	["mitre-attack","enterprise","t1027.013","defense-evasion","linux","macos","windows","sub-technique"]
technique_id	T1027.013
tactic	defense-evasion
all_tactics	["defense-evasion"]
platforms	["Linux","macOS","Windows"]
mitre_url	https://attack.mitre.org/techniques/T1027/013
tech_stack	["linux","macos","windows"]
cwe_ids	["CWE-693"]
chains_with	["T1027","T1027.001","T1027.002","T1027.003","T1027.004","T1027.005","T1027.006","T1027.007","T1027.008","T1027.009","T1027.010","T1027.011","T1027.012","T1027.014","T1027.015","T1027.016","T1027.017"]
prerequisites	["T1027"]
severity_boost	{"T1027":"Chain with T1027 for deeper attack path","T1027.001":"Chain with T1027.001 for deeper attack path","T1027.002":"Chain with T1027.002 for deeper attack path"}

T1027.013 Encrypted/Encoded File

Sub-technique of: T1027

High-Level Description

Adversaries may encrypt or encode files to obfuscate strings, bytes, and other specific patterns to impede detection. Encrypting and/or encoding file content aims to conceal malicious artifacts within a file used in an intrusion. Many other techniques, such as Software Packing, Steganography, and Embedded Payloads, share this same broad objective. Encrypting and/or encoding files could lead to a lapse in detection of static signatures, only for this malicious content to be revealed (i.e., Deobfuscate/Decode Files or Information) at the time of execution/use.

This type of file obfuscation can be applied to many file artifacts present on victim hosts, such as malware log/configuration and payload files. Files can be encrypted with a hardcoded or user-supplied key, as well as otherwise obfuscated using standard encoding schemes such as Base64.

The entire content of a file may be obfuscated, or just specific functions or values (such as C2 addresses). Encryption and encoding may also be applied in redundant layers for additional protection.

For example, adversaries may abuse password-protected Word documents or self-extracting (SFX) archives as a method of encrypting/encoding a file such as a Phishing payload. These files typically function by attaching the intended archived content to a decompressor stub that is executed when the file is invoked (e.g., User Execution).

Adversaries may also abuse file-specific as well as custom encoding schemes. For example, Byte Order Mark (BOM) headers in text files may be abused to manipulate and obfuscate file content until Command and Scripting Interpreter execution.

Kill Chain Phase

• Defense Evasion (TA0005)

Platforms: Linux, macOS, Windows

What to Check

• Identify if Encrypted/Encoded File technique is applicable to target environment
• Check Linux systems for indicators of Encrypted/Encoded File
• Check macOS systems for indicators of Encrypted/Encoded File
• Check Windows systems for indicators of Encrypted/Encoded File
• Verify mitigations are bypassed or absent (2 known mitigations)
• Assess detection coverage (1 detection strategies)

How to Test

Atomic Red Team Tests

The following tests are from and provide actionable ways to test this technique: