Deobfuscate/Decode Files or Information
Adversaries may use [Obfuscated Files or Information](https://attack.mitre.org/techniques/T1027) to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system. One such example is the use of [certutil](https://attack.mitre.org/software/S0160) to decode a remote access tool portable e...
BY SOURCE
PROCEDURES (38)
Auto-extracted: 6 detections for amsi
Auto-extracted: 4 detections for bypass
Auto-extracted: 4 detections for base64
Auto-extracted: 3 detections for suspicious
Auto-extracted: 2 detections for encrypt
Auto-extracted: 2 detections for token
Auto-extracted: 2 detections for obfuscat
Auto-extracted: 2 detections for suspicious
Auto-extracted: 1 detections for child process
Auto-extracted: 1 detections for bypass
Auto-extracted: 1 detections for kernel monitoring
Auto-extracted: 1 detections for http
Auto-extracted: 1 detections for unusual
Auto-extracted: 1 detections for download
Auto-extracted: 1 detections for process creation monitoring
Auto-extracted: 1 detections for obfuscat
Auto-extracted: 1 detections for obfuscat
Auto-extracted: 1 detections for encrypt
Auto-extracted: 1 detections for unusual
Auto-extracted: 1 detections for amsi
Auto-extracted: 1 detections for powershell
Auto-extracted: 1 detections for script block
Auto-extracted: 1 detections for service
Auto-extracted: 1 detections for service
Auto-extracted: 1 detections for child process
Auto-extracted: 1 detections for container
Auto-extracted: 1 detections for suspicious
Auto-extracted: 1 detections for powershell
Auto-extracted: 1 detections for command and control
Auto-extracted: 1 detections for container
Auto-extracted: 1 detections for inject
Auto-extracted: 1 detections for exfiltrat
Auto-extracted: 1 detections for base64
Auto-extracted: 1 detections for download
Auto-extracted: 1 detections for command line monitoring
Auto-extracted: 1 detections for http
Auto-extracted: 1 detections for container
Auto-extracted: 1 detections for evasion