T1027.010 — Command Obfuscation

Tactic: Stealth · Platforms: Linux, macOS, Windows

Adversaries may obfuscate content during command execution to impede detection. Command-line obfuscation is a method of making strings and patterns within commands and scripts more difficult to signature and analyze. This type of obfuscation can be included within commands executed by delivered…

Sub-technique of Obfuscated Files or Information (T1027).

Sigma detection rules (3)

T1027.010 Obfuscated Files or Information: Command Obfuscation

title: "T1027.010 Obfuscated Files or Information: Command Obfuscation"
id: 34ec475c-6156-4202-8625-5d873b4c6c09
description: 'Detection Strategy for Command Obfuscation. (Retargeted to Sysmon EventID matching process_creation telemetry for reliable field coverage.) Tune using: CommandLineEntropyThreshold, SuspiciousCharacterCount, TimeWindow.'
references:
  - https://attack.mitre.org/techniques/T1027/010
author: Shahrukh Khan
date: 2026-05-05
license: MIT
tags:
  - attack.stealth
  - attack.t1027.010

logsource:
  category: process_creation
  product: windows
  service: sysmon

detection:
  selection:
    CommandLine|re: '([\^"`]{3,})'

  filter_common:
    CommandLine|contains: 'Program Files'

  condition: selection and not filter_common

falsepositives:
  - Some legitimate installers and batch scripts use repeated escape characters for quoting; tune the regex threshold against your environment's real command-line baseline.

level: medium

T1027.010 Obfuscated Files or Information: Command Obfuscation

title: "T1027.010 Obfuscated Files or Information: Command Obfuscation"
id: f8f3456b-3a0a-4af7-85ab-0725e59f26b5
description: 'Detection Strategy for Command Obfuscation. (Retargeted to the process_creation auditd telemetry that actually captures this techniques behavior; see logsource below.) Tune using: CommandLineTokenCount, EncodedExecRegex, GlobPatternAnomalies.'
references:
  - https://attack.mitre.org/techniques/T1027/010
author: Shahrukh Khan
date: 2026-01-25
license: MIT
tags:
  - attack.stealth
  - attack.t1027.010

logsource:
  category: process_creation
  product: linux

detection:
  selection_shell:
    type: EXECVE
    a0|endswith:
      - '/bash'
      - '/sh'
    a1: '-c'
  selection_encoded:
    a2|contains:
      - 'base64'
      - '${IFS}'
      - 'eval'
  condition: all of selection_*

falsepositives:
  - Legitimate shell scripts and automation tools frequently use base64, eval, or IFS substitution for benign templating purposes.

level: medium

T1027.010 Obfuscated Files or Information: Command Obfuscation

title: "T1027.010 Obfuscated Files or Information: Command Obfuscation"
id: 6e515a93-db53-4758-8aea-9a4d1052e8b2
description: 'Detection Strategy for Command Obfuscation. (Retargeted to the process_creation macOS unified-log telemetry that actually captures this techniques behavior; see logsource below.) Tune using: InterpreterParentFilter, ScriptEntropyThreshold, ArgumentLengthDeviation.'
references:
  - https://attack.mitre.org/techniques/T1027/010
author: Shahrukh Khan
date: 2026-06-23
license: MIT
tags:
  - attack.stealth
  - attack.t1027.010

logsource:
  category: process_creation
  product: macos

detection:
  selection:
    Image|endswith:
      - '/bash'
      - '/zsh'
  selection_parent:
    ParentImage|endswith: '/osascript'
  selection_args:
    CommandLine|contains|all:
      - '${IFS}'
      - '\\x'
  condition: (selection and selection_parent) or selection_args

falsepositives:
  - Complex shell one-liners written by administrators that happen to use unusual quoting or variable substitution.

level: medium

Related sub-techniques

Explore