T1027.009 — Embedded Payloads

Tactic: Stealth · Platforms: Linux, macOS, Windows

Adversaries may embed payloads within other files to conceal malicious content from defenses. Otherwise seemingly benign files (such as scripts and executables) may be abused to carry and obfuscate malicious payloads and content. In some cases, embedded payloads may also enable adversaries to…

Sub-technique of Obfuscated Files or Information (T1027).

Sigma detection rules (3)

T1027.009 Obfuscated Files or Information: Embedded Payloads

title: "T1027.009 Obfuscated Files or Information: Embedded Payloads"
id: fc3e64d7-414e-4ad0-9dfd-c2f3d2ab2dc5
description: 'Detection Strategy for Embedded Payloads. (Data Component: File Creation; baseline tier: windows-eventid.) Tune using: OverlaySizeThreshold, ProcessTreeDepth, TimeWindow.'
references:
  - https://attack.mitre.org/techniques/T1027/009
author: Shahrukh Khan
date: 2026-01-22
license: MIT
tags:
  - attack.stealth
  - attack.t1027.009

logsource:
  product: windows

detection:
  selection_base:
    EventID: '11'
  selection_carrier_process:
    Image|endswith:
      - '\WINWORD.EXE'
      - '\EXCEL.EXE'
      - '\POWERPNT.EXE'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\mshta.exe'
  selection_payload_ext:
    TargetFilename|endswith:
      - '.exe'
      - '.dll'
      - '.scr'
      - '.ps1'

  filter_system_account:
    User|contains:
      - 'SYSTEM'
      - 'LOCAL SERVICE'
      - 'NETWORK SERVICE'

  condition: selection_base and selection_carrier_process and selection_payload_ext and not filter_system_account

falsepositives:
  - System and service accounts (SYSTEM, LOCAL SERVICE, NETWORK SERVICE) performing the same action are excluded via filter_system_account; tune further with process/path allowlists if noise remains.
  - Legitimate macro-driven Office add-ins or logon scripts that intentionally drop signed executables/DLLs.

level: medium

T1027.009 Obfuscated Files or Information: Embedded Payloads

title: "T1027.009 Obfuscated Files or Information: Embedded Payloads"
id: 4b2410fc-e4f8-4bc1-a5a9-8f2bca29e97f
description: 'Auditd cannot inspect file structure or content, so true detection of an embedded/polyglot payload (verifying appended data past an EOF marker or a format/magic-byte mismatch) is not observable with this telemetry. The closest defensible proxy is dd(1) invoked with both conv=notrunc (preserve existing file content) and seek= (write starting at a specific offset), the argv pattern used to overlay/append a second payload onto an existing file without truncating it -- a materially narrower and more specific signal than the previous versions bare "dd or cat was executed", which matched nearly all routine dd/cat usage.'
references:
  - https://attack.mitre.org/techniques/T1027/009
author: Shahrukh Khan
date: 2026-02-18
license: MIT
tags:
  - attack.stealth
  - attack.t1027.009

logsource:
  category: process_creation
  product: linux
  service: auditd

detection:
  selection_dd:
    type: EXECVE
    a0|endswith: '/dd'
  selection_notrunc:
    - a1|contains: 'conv=notrunc'
    - a2|contains: 'conv=notrunc'
    - a3|contains: 'conv=notrunc'
    - a4|contains: 'conv=notrunc'
  selection_seek:
    - a1|contains: 'seek='
    - a2|contains: 'seek='
    - a3|contains: 'seek='
    - a4|contains: 'seek='
  condition: selection_dd and selection_notrunc and selection_seek

falsepositives:
  - Legitimate low-level disk/partition operations, bootloader/MBR writes, and some backup/imaging tools use dd with conv=notrunc and seek= for non-malicious partial writes; this remains a heuristic proxy, not confirmation of an embedded payload.

level: medium

T1027.009 Obfuscated Files or Information: Embedded Payloads

title: "T1027.009 Obfuscated Files or Information: Embedded Payloads"
id: a7fa653a-54bf-433f-861f-ed75b4db2b18
description: 'Detection Strategy for Embedded Payloads. (Retargeted to the file_event macOS unified-log telemetry that actually captures this techniques behavior; see logsource below.) Tune using: ScriptFormatType, DroppedBinaryCount, ParentProcessName.'
references:
  - https://attack.mitre.org/techniques/T1027/009
author: Shahrukh Khan
date: 2026-05-11
license: MIT
tags:
  - attack.stealth
  - attack.t1027.009

logsource:
  category: file_event
  product: macos

detection:
  selection:
    Image|endswith:
      - '/osascript'
      - '/python3'
  selection_target:
    TargetFilename|contains: '/private/tmp/'
  condition: selection and selection_target

falsepositives:
  - Scripting tools that legitimately extract bundled resources to a temporary directory during installation.

level: medium

Related sub-techniques

Explore