EXPLORE
← Back to Explore
T1027

Obfuscated Files or Information

Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses. Payloads may be compressed, archived, or encrypted in order to avoid detection. These payloads may be used during Initial Access or later to mitigate detection. Sometimes a user's action may be required to open and [...

ESXiLinuxmacOSNetwork DevicesWindows
525
Detections
5
Sources
18
Threat Actors

BY SOURCE

383sublime87sigma43elastic11splunk_escu1crowdstrike_cql

PROCEDURES (122)

General Monitoring30 detections

Auto-extracted: 30 detections for general monitoring

Powershell25 detections

Auto-extracted: 25 detections for powershell

Attachment24 detections

Auto-extracted: 24 detections for attachment

Email Security22 detections

Auto-extracted: 22 detections for email security

Powershell21 detections

Auto-extracted: 21 detections for powershell

Authentication Monitoring20 detections

Auto-extracted: 20 detections for authentication monitoring

Email17 detections

Auto-extracted: 17 detections for email

Credential15 detections

Auto-extracted: 15 detections for credential

Powershell13 detections

Auto-extracted: 13 detections for powershell

Script Execution Monitoring13 detections

Auto-extracted: 13 detections for script execution monitoring

Attachment12 detections

Auto-extracted: 12 detections for attachment

Service12 detections

Auto-extracted: 12 detections for service

Impersonat11 detections

Auto-extracted: 11 detections for impersonat

Amsi10 detections

Auto-extracted: 10 detections for amsi

Base6410 detections

Auto-extracted: 10 detections for base64

Suspicious9 detections

Auto-extracted: 9 detections for suspicious

Base648 detections

Auto-extracted: 8 detections for base64

Network Connection Monitoring8 detections

Auto-extracted: 8 detections for network connection monitoring

Credential8 detections

Auto-extracted: 8 detections for credential

Impersonat7 detections

Auto-extracted: 7 detections for impersonat

Phish7 detections

Auto-extracted: 7 detections for phish

Bypass7 detections

Auto-extracted: 7 detections for bypass

Suspicious6 detections

Auto-extracted: 6 detections for suspicious

Bypass6 detections

Auto-extracted: 6 detections for bypass

Email6 detections

Auto-extracted: 6 detections for email

Service5 detections

Auto-extracted: 5 detections for service

Phish5 detections

Auto-extracted: 5 detections for phish

Ransomware5 detections

Auto-extracted: 5 detections for ransomware

Base645 detections

Auto-extracted: 5 detections for base64

Credential5 detections

Auto-extracted: 5 detections for credential

Phish5 detections

Auto-extracted: 5 detections for phish

Credential4 detections

Auto-extracted: 4 detections for credential

Download4 detections

Auto-extracted: 4 detections for download

Download4 detections

Auto-extracted: 4 detections for download

Service4 detections

Auto-extracted: 4 detections for service

Process Creation Monitoring4 detections

Auto-extracted: 4 detections for process creation monitoring

Script Block4 detections

Auto-extracted: 4 detections for script block

Encrypt4 detections

Auto-extracted: 4 detections for encrypt

Unusual4 detections

Auto-extracted: 4 detections for unusual

Encrypt4 detections

Auto-extracted: 4 detections for encrypt

Obfuscat4 detections

Auto-extracted: 4 detections for obfuscat

Credential4 detections

Auto-extracted: 4 detections for credential

Attachment4 detections

Auto-extracted: 4 detections for attachment

Suspicious4 detections

Auto-extracted: 4 detections for suspicious

Bypass4 detections

Auto-extracted: 4 detections for bypass

Office3 detections

Auto-extracted: 3 detections for office

Evasion3 detections

Auto-extracted: 3 detections for evasion

Download3 detections

Auto-extracted: 3 detections for download

Encrypt2 detections

Auto-extracted: 2 detections for encrypt

Office2 detections

Auto-extracted: 2 detections for office

Office2 detections

Auto-extracted: 2 detections for office

Cloud2 detections

Auto-extracted: 2 detections for cloud

Suspicious2 detections

Auto-extracted: 2 detections for suspicious

Bypass2 detections

Auto-extracted: 2 detections for bypass

Http2 detections

Auto-extracted: 2 detections for http

Unusual2 detections

Auto-extracted: 2 detections for unusual

Attachment2 detections

Auto-extracted: 2 detections for attachment

Office2 detections

Auto-extracted: 2 detections for office

Macro2 detections

Auto-extracted: 2 detections for macro

Attachment2 detections

Auto-extracted: 2 detections for attachment

Exfiltrat2 detections

Auto-extracted: 2 detections for exfiltrat

Persist2 detections

Auto-extracted: 2 detections for persist

Suspicious2 detections

Auto-extracted: 2 detections for suspicious

Exfiltrat2 detections

Auto-extracted: 2 detections for exfiltrat

Impersonat2 detections

Auto-extracted: 2 detections for impersonat

Phish2 detections

Auto-extracted: 2 detections for phish

Suspicious2 detections

Auto-extracted: 2 detections for suspicious

Unusual2 detections

Auto-extracted: 2 detections for unusual

Http2 detections

Auto-extracted: 2 detections for http

Evasion2 detections

Auto-extracted: 2 detections for evasion

Evasion2 detections

Auto-extracted: 2 detections for evasion

Powershell2 detections

Auto-extracted: 2 detections for powershell

Evasion2 detections

Auto-extracted: 2 detections for evasion

Obfuscat2 detections

Auto-extracted: 2 detections for obfuscat

Token2 detections

Auto-extracted: 2 detections for token

Service2 detections

Auto-extracted: 2 detections for service

Api2 detections

Auto-extracted: 2 detections for api

Office1 detections

Auto-extracted: 1 detections for office

Macro1 detections

Auto-extracted: 1 detections for macro

Aws1 detections

Auto-extracted: 1 detections for aws

Oauth1 detections

Auto-extracted: 1 detections for oauth

Inject1 detections

Auto-extracted: 1 detections for inject

File Monitoring1 detections

Auto-extracted: 1 detections for file monitoring

Api1 detections

Auto-extracted: 1 detections for api

Download1 detections

Auto-extracted: 1 detections for download

Oauth1 detections

Auto-extracted: 1 detections for oauth

Service1 detections

Auto-extracted: 1 detections for service

Command And Control1 detections

Auto-extracted: 1 detections for command and control

Token1 detections

Auto-extracted: 1 detections for token

Http1 detections

Auto-extracted: 1 detections for http

Email1 detections

Auto-extracted: 1 detections for email

Parent Process1 detections

Auto-extracted: 1 detections for parent process

Inject1 detections

Auto-extracted: 1 detections for inject

Email1 detections

Auto-extracted: 1 detections for email

Remote1 detections

Auto-extracted: 1 detections for remote

Exfiltrat1 detections

Auto-extracted: 1 detections for exfiltrat

Download1 detections

Auto-extracted: 1 detections for download

Base641 detections

Auto-extracted: 1 detections for base64

Base641 detections

Auto-extracted: 1 detections for base64

Powershell1 detections

Auto-extracted: 1 detections for powershell

Encrypt1 detections

Auto-extracted: 1 detections for encrypt

Obfuscat1 detections

Auto-extracted: 1 detections for obfuscat

Inject1 detections

Auto-extracted: 1 detections for inject

Command Line Monitoring1 detections

Auto-extracted: 1 detections for command line monitoring

Cloud1 detections

Auto-extracted: 1 detections for cloud

Amsi1 detections

Auto-extracted: 1 detections for amsi

Script Block1 detections

Auto-extracted: 1 detections for script block

Token1 detections

Auto-extracted: 1 detections for token

Parent Process1 detections

Auto-extracted: 1 detections for parent process

Impersonat1 detections

Auto-extracted: 1 detections for impersonat

Container1 detections

Auto-extracted: 1 detections for container

Evasion1 detections

Auto-extracted: 1 detections for evasion

Base641 detections

Auto-extracted: 1 detections for base64

Container1 detections

Auto-extracted: 1 detections for container

Impersonat1 detections

Auto-extracted: 1 detections for impersonat

Aws1 detections

Auto-extracted: 1 detections for aws

Exfiltrat1 detections

Auto-extracted: 1 detections for exfiltrat

Service1 detections

Auto-extracted: 1 detections for service

Unusual1 detections

Auto-extracted: 1 detections for unusual

Privilege1 detections

Auto-extracted: 1 detections for privilege

Cloud1 detections

Auto-extracted: 1 detections for cloud

Command And Control1 detections

Auto-extracted: 1 detections for command and control

DETECTIONS (525)

Abuse: Cloudflare Workers Hosted EvilTokens Domain Structure
sublimehigh
Adobe branded PDF file linking to a password-protected file from untrusted sender
sublimehigh
Attachment with encrypted zip (unsolicited)
sublimemedium
Attachment with macro calling executable
sublimehigh
Attachment with unscannable encrypted zip (unsolicited)
sublimemedium
Attachment: .csproj with suspicious commands
sublimehigh
Attachment: 7z Archive Containing RAR File
sublimemedium
Attachment: Any .sap file (unsolicited)
sublimelow
Attachment: Any HTML file within archive (unsolicited)
sublimemedium
Attachment: Archive containing disallowed file type
sublimelow
Attachment: Archive containing HTML file with file scheme link
sublimehigh
Attachment: Archive with embedded CHM file
sublimemedium
Attachment: Archive with embedded EXE file
sublimehigh
Attachment: Archive with pdf, txt and wsf files
sublimemedium
Attachment: Base64 encoded bash command in filename
sublimehigh
Attachment: Calendar file with invisible Unicode characters
sublimehigh
Attachment: Calendar invite from recently registered domain
sublimehigh
Attachment: Callback phishing solicitation via image file
sublimehigh
Attachment: Callback phishing solicitation via pdf file
sublimehigh
Attachment: Callback phishing solicitation via text-based file
sublimemedium
Attachment: DocX embedded binary
sublimehigh
Attachment: DOCX with hyperlink targeting recipient address
sublimemedium
Attachment: Double base64-encoded zip file in HTML smuggling attachment
sublimehigh
Attachment: Embedded VBScript in MHT file (unsolicited)
sublimemedium
Attachment: EML containing a base64 encoded script
sublimehigh
Attachment: EML file contains HTML attachment with login portal indicators
sublimehigh
Attachment: EML file with HTML attachment (unsolicited)
sublimemedium
Attachment: EML file with IPFS links
sublimemedium
Attachment: EML with embedded Javascript in SVG file
sublimehigh
Attachment: EML with Encrypted ZIP
sublimelow
Attachment: EML with link to credential phishing page
sublimehigh
Attachment: EML with QR code redirecting to Cloudflare challenges
sublimelow
Attachment: EML with SharePoint files shared from GoDaddy federated tenants
sublimelow
Attachment: EML with Sharepoint link likely unrelated to sender
sublimemedium
Attachment: EML with suspicious indicators
sublimemedium
Attachment: Emotet heavily padded doc in zip file
sublimehigh
Attachment: Employment contract update with suspicious file naming
sublimehigh
Attachment: Encrypted Microsoft Office file (unsolicited)
sublimemedium
Attachment: Encrypted PDF with credential theft body
sublimemedium
Attachment: Encrypted ZIP containing VHDX file
sublimemedium
Attachment: Encrypted zip file with payment-related lure
sublimemedium
Attachment: Excel file with suspicious template identifier
sublimehigh
Attachment: Excel Web Query File (IQY)
sublimehigh
Attachment: Fake attachment image lure
sublimemedium
Attachment: Fake Slack installer
sublimehigh
Attachment: Fake Zoom installer
sublimehigh
Attachment: File execution via Javascript
sublimemedium
Attachment: Filename containing Unicode braille pattern blank character
sublimehigh
Attachment: Filename containing Unicode right-to-left override character
sublimehigh
Attachment: Finance themed PDF with observed phishing template
sublimemedium
Attachment: HTML attachment with Javascript location
sublimehigh
Attachment: HTML file contains exclusively Javascript
sublimemedium
Attachment: HTML file with excessive 'const' declarations and abnormally long timeouts
sublimehigh
Attachment: HTML file with excessive padding and suspicious patterns
sublimehigh
Attachment: HTML smuggling 'body onload' linking to suspicious destination
sublimehigh
Attachment: HTML smuggling 'body onload' with high entropy and suspicious text
sublimehigh
Attachment: HTML smuggling with atob and high entropy via calendar invite
sublimehigh
Attachment: HTML smuggling with base64 encoded ZIP file
sublimemedium
Attachment: HTML smuggling with concatenation obfuscation
sublimehigh
Attachment: HTML smuggling with decimal encoding
sublimehigh
Attachment: HTML smuggling with embedded base64-encoded executable
sublimehigh
Attachment: HTML smuggling with embedded base64-encoded ISO
sublimehigh
Attachment: HTML smuggling with eval and atob
sublimehigh
Attachment: HTML smuggling with eval and atob via calendar invite
sublimehigh
Attachment: HTML smuggling with excessive line break obfuscation
sublimehigh
Attachment: HTML smuggling with excessive string concatenation and suspicious patterns
sublimemedium
Attachment: HTML smuggling with fromCharCode and other signals
sublimehigh
Attachment: HTML smuggling with hex strings
sublimemedium
Attachment: HTML smuggling with high entropy and other signals
sublimehigh
Attachment: HTML smuggling with raw array buffer
sublimehigh
Attachment: HTML smuggling with RC4 decryption
sublimehigh
Attachment: HTML smuggling with ROT13
sublimehigh
Attachment: HTML smuggling with setTimeout
sublimehigh
Attachment: HTML smuggling with unescape
sublimehigh
Attachment: HTML with emoji-to-character map
sublimehigh
Attachment: HTML with hidden body
sublimehigh
Attachment: HTML with JavaScript functions for HTTP requests
sublimehigh
Attachment: ICS calendar with embedded file from internal sender with SPF failure
sublimehigh
Attachment: ICS file with AWS Lambda URL
sublimemedium
Attachment: ICS file with excessive custom properties
sublimemedium
Attachment: ICS file with non-Gregorian calendar scale
sublimemedium
Attachment: ICS with embedded document
sublimelow
Attachment: ICS with embedded Javascript in SVG file
sublimehigh
Attachment: ICS with employee policy review lure
sublimehigh
Attachment: JavaScript file with suspicious base64-encoded executable
sublimehigh
Attachment: Legal themed message or PDF with suspicious indicators
sublimemedium
Attachment: Link file with UNC path
sublimemedium
Attachment: Link to Doubleclick.net open redirect
sublimemedium
Attachment: Macro files containing MHT content
sublimemedium
Attachment: Malformed OLE file
sublimehigh
Attachment: MS Office or RTF file with Shell.Explorer.1 com object with embedded LNK
sublimemedium
Attachment: MSI installer file
sublimemedium
Attachment: Office file contains OLE relationship to credential phishing page
sublimehigh
Attachment: Office file with credential phishing URLs
sublimemedium
Attachment: Office file with document sharing and browser instruction lures
sublimehigh
Attachment: Office file with suspicious function calls or downloaded file path
sublimehigh
Attachment: OLE external relationship containing file scheme link to executable filetype
sublimehigh
Attachment: OLE external relationship containing file scheme link to IP address
sublimehigh
Attachment: Password-protected PDF with fake document indicators
sublimemedium
Attachment: PDF file with low reputation link to ZIP file (unsolicited)
sublimemedium
Attachment: PDF file with low reputation links to suspicious filetypes (unsolicited)
sublimemedium
Attachment: PDF generated with wkhtmltopdf tool and default title
sublimelow
Attachment: PDF Object Hash - Encrypted PDFs with fake payment notification
sublimemedium
Attachment: PDF proposal with credential theft indicators
sublimehigh
Attachment: PDF with a suspicious string and single URL
sublimehigh
Attachment: PDF with embedded Javascript
sublimemedium
Attachment: PDF with link to DMG file download
sublimemedium
Attachment: PDF with link to zip containing a wsf file
sublimehigh
Attachment: PDF with multistage landing - ClickUp abuse
sublimehigh
Attachment: PDF with password in filename matching body text
sublimemedium
Attachment: PDF with recipient email in link
sublimehigh
Attachment: PDF with ReportLab library and default metadata
sublimelow
Attachment: PDF with suspicious HeadlessChrome metadata
sublimemedium
Attachment: PDF with suspicious language and redirect to suspicious file type
sublimehigh
Attachment: PDF with suspicious link and action-oriented language
sublimehigh
Attachment: Potential sandbox evasion in Office file
sublimehigh
Attachment: PowerPoint with suspicious hyperlink
sublimehigh
Attachment: Python generated PDF with link
sublimemedium
Attachment: QR code link with base64-encoded recipient address
sublimehigh
Attachment: QR code with encoded recipient targeting and redirect indicators
sublimehigh
Attachment: QR code with recipient targeting and special characters
sublimehigh
Attachment: QR code with suspicious URL patterns in EML file
sublimehigh
Attachment: QR code with userinfo portion
sublimehigh
Attachment: RFC822 containing suspicious file sharing language with links from untrusted sender
sublimemedium
Attachment: RTF file with suspicious link
sublimemedium
Attachment: RTF with embedded content
sublimemedium
Attachment: Self-sender PDF with minimal content and view prompt
sublimehigh
Attachment: SFX archive containing commands
sublimemedium
Attachment: Small text file with link containing recipient email address
sublimemedium
Attachment: Suspicious employee policy update document lure
sublimemedium
Attachment: Suspicious PDF created with headless browser
sublimehigh
Attachment: SVG files with evasion elements
sublimehigh
Attachment: Web files with suspicious comments
sublimehigh
Attachment: WinRAR CVE-2025-8088 exploitation
sublimehigh
Attachment: XLSX file with suspicious print titles metadata
sublimehigh
Attachment: ZIP file with CVE-2026-0866 exploit
sublimemedium
Base16 or Base32 Encoding/Decoding Activity
elasticmedium
Base64 Decoded Payload Piped to Interpreter
elastichigh
Base64 Encoded PowerShell Command Detected
sigmahigh
BEC with unusual reply-to or return-path mismatch
sublimehigh
BEC/Fraud: Reply-chain manipulation with urgent keywords and self-reply
sublimemedium
Benefits enrollment impersonation
sublimehigh
Body HTML: Comment with 24-character hex token
sublimelow
Body HTML: Recipient SLD in HTML class
sublimemedium
Body: Embedded email headers indicative of thread hijacking/abuse
sublimemedium
Brand impersonation: Coinbase with suspicious links
sublimemedium
Brand impersonation: DocuSign with embedded QR code
sublimehigh
Brand impersonation: File sharing notification with template artifacts
sublimelow
Brand impersonation: Microsoft logo in HTML with fake quarantine release notification
sublimehigh
Brand impersonation: Microsoft Planner with suspicious link
sublimemedium
Brand impersonation: QuickBooks notification from Intuit themed company name
sublimemedium
Brand Impersonation: ShareFile
sublimemedium
Brand impersonation: SharePoint PDF attachment with credential theft language
sublimemedium
Brand impersonation: Stripe notification
sublimemedium
Brand impersonation: Zoom
sublimemedium
Business Email Compromise (BEC) attempt with masked recipients and reply-to mismatch (unsolicited)
sublimemedium
Callback phishing via Adobe Sign comment
sublimehigh
Callback phishing via calendar invite
sublimemedium
Callback phishing via DocuSign comment
sublimehigh
Callback phishing via Intuit service abuse
sublimemedium
Callback phishing via Zelle Service Abuse
sublimemedium
Callback phishing via Zoho service abuse
sublimemedium
Callback phishing: Social Security Administration fraud
sublimemedium
Callback phishing: SumUp infrastructure abuse
sublimehigh
Canva design with suspicious embedded link
sublimehigh
Certificate Exported Via Certutil.EXE
sigmamedium
Cisco Secure Firewall - Lumma Stealer Activity
splunk_escu
Cisco Secure Firewall - Repeated Malware Downloads
splunk_escu
Cisco Secure Firewall - Snort Rule Triggered Across Multiple Hosts
splunk_escu
Command Line Obfuscation via Whitespace Padding
elasticmedium
Command Obfuscation via Unicode Modifier Letters
elastichigh
ConvertTo-SecureString Cmdlet Usage Via CommandLine
sigmamedium
Credential Phishing via Dropbox comment abuse
sublimemedium
Credential phishing: Generic document share template
sublimelow
Credential phishing: Generic document sharing
sublimemedium
Credential phishing: Hyper-linked image leading to free file host
sublimemedium
Credential phishing: Image as content, short or no body contents
sublimemedium
Credential Phishing: Suspicious language, link, recipients and other indicators
sublimemedium
Credential Phishing: W-2 lure with inline SVG Windows logo
sublimehigh
Credential theft with 'safe content' deception and social engineering topics
sublimemedium
Credential theft: Gophish abuse with hidden tracking image
sublimehigh
Curl Execution with Percent Encoded URL
splunk_escu
CVE-2023-5631 - Roundcube Webmail XSS via crafted SVG
sublimecritical
Cyrillic vowel substitution in subject or display name from unknown sender
sublimemedium
Cyrillic vowel substitutions with suspicious subject from unknown sender
sublimemedium
Data Encrypted via OpenSSL Utility
elasticlow
Decode Base64 Encoded Text
sigmalow
Decode Base64 Encoded Text -MacOs
sigmalow
Decoded Payload Piped to Interpreter Detected via Defend for Containers
elastichigh
Deprecated - Encoded Executable Stored in the Registry
elasticmedium
Deprecated - Potential PowerShell Obfuscated Script
elasticlow
Display Name Emoji with Financial Symbols
sublimelow
Dynamic IEX Reconstruction via Method String Access
elasticlow
EML attachment with credential theft language (unknown sender)
sublimehigh
Encoded Payload Detected via Defend for Containers
elasticmedium
Encrypted Microsoft Office files from untrusted sender
sublimemedium
Fake shipping notification with suspicious language
sublimemedium
Fake thread with suspicious indicators
sublimemedium
Fake warning banner using confusable characters
sublimemedium
Fake Zoho Sign template abuse
sublimemedium