T1027.013 — Encrypted/Encoded File

Tactic: Stealth · Platforms: Linux, macOS, Windows

Adversaries may encrypt or encode files to obfuscate strings, bytes, and other specific patterns to impede detection. Encrypting and/or encoding file content aims to conceal malicious artifacts within a file used in an intrusion. Many other techniques, such as Software Packing, Steganography, and…

Sub-technique of Obfuscated Files or Information (T1027).

Sigma detection rules (3)

T1027.013 Obfuscated Files or Information: Encrypted/Encoded File

title: "T1027.013 Obfuscated Files or Information: Encrypted/Encoded File"
id: 76df68d4-f32f-40a8-bd4c-dcf69e3b5370
description: 'Encrypted or Encoded File Payload Detection Strategy. Detects use of certutil for encode/decode operations and PowerShell encoded-command/Base64-decode execution, both common LOLBin patterns for delivering or unpacking encrypted/encoded file content on disk. (Data Component: Process Creation; baseline tier: windows-eventid.) Tune using: Image, CommandLine, TimeWindow.'
references:
  - https://attack.mitre.org/techniques/T1027/013
author: Shahrukh Khan
date: 2026-02-24
license: MIT
tags:
  - attack.stealth
  - attack.t1027.013

logsource:
  category: process_creation
  product: windows
  service: sysmon

detection:
  selection_certutil_codec:
    Image|endswith: '\certutil.exe'
    CommandLine|contains:
      - '-decode'
      - '-encode'
      - '-decodehex'
  selection_encoded_powershell:
    Image|endswith:
      - '\powershell.exe'
      - '\pwsh.exe'
    CommandLine|contains:
      - '-EncodedCommand'
      - '-enc '
      - 'FromBase64String'
  selection_cab_expand:
    Image|endswith:
      - '\makecab.exe'
      - '\expand.exe'

  filter_system_account:
    User|contains:
      - 'SYSTEM'
      - 'LOCAL SERVICE'
      - 'NETWORK SERVICE'

  condition: (1 of selection_*) and not filter_system_account

falsepositives:
  - Legitimate certificate management via certutil; administrative PowerShell scripts using Base64 for data transport; software packaging using makecab/expand.
  - System and service accounts (SYSTEM, LOCAL SERVICE, NETWORK SERVICE) performing the same action are excluded via filter_system_account; tune further with process/path allowlists if noise remains.

level: medium

T1027.013 Obfuscated Files or Information: Encrypted/Encoded File

title: "T1027.013 Obfuscated Files or Information: Encrypted/Encoded File"
id: c3dd31d7-fa72-4d15-a0ab-93c3e5657af5
description: 'Encrypted or Encoded File Payload Detection Strategy. Added coverage for base64 encode/decode invocations alongside openssl enc, since the technique description explicitly names simple encoding schemes (base64) as an equally common obfuscation method the prior version could not catch. Also added a context filter requiring the target/output path to be a non-standard staging directory (/tmp, /dev/shm, /var/tmp), reducing the high noise from routine admin-script base64/openssl use acknowledged in the falsepositives note. (Retargeted to the process_creation auditd telemetry that actually captures this techniques behavior; see logsource below.) Tune using: UserContext, ProcessLineage, TimeWindow.'
references:
  - https://attack.mitre.org/techniques/T1027/013
author: Shahrukh Khan
date: 2026-05-28
license: MIT
tags:
  - attack.stealth
  - attack.t1027.013

logsource:
  category: process_creation
  product: linux

detection:
  selection_openssl:
    type: EXECVE
    a0|endswith: '/openssl'
    a1: 'enc'
  selection_base64:
    type: EXECVE
    a0|endswith: '/base64'
  selection_staging_dir:
    - a1|contains:
        - '/tmp/'
        - '/dev/shm/'
        - '/var/tmp/'
    - a2|contains:
        - '/tmp/'
        - '/dev/shm/'
        - '/var/tmp/'

  condition: (selection_openssl or selection_base64) and selection_staging_dir

falsepositives:
  - Legitimate administrators and scripts routinely use openssl enc or base64 for backups, certificate handling, or data-at-rest encryption unrelated to malware staging, particularly when operating within /tmp for legitimate temporary processing.

level: medium

T1027.013 Obfuscated Files or Information: Encrypted/Encoded File

title: "T1027.013 Obfuscated Files or Information: Encrypted/Encoded File"
id: bede37b9-b087-4845-9a86-4b98dc4c424c
description: 'Encrypted or Encoded File Payload Detection Strategy. (Retargeted to the process_creation macOS unified-log telemetry that actually captures this techniques behavior; see logsource below.) Tune using: ScriptContent, ExecutionChain, UserContext.'
references:
  - https://attack.mitre.org/techniques/T1027/013
author: Shahrukh Khan
date: 2026-06-03
license: MIT
tags:
  - attack.stealth
  - attack.t1027.013

logsource:
  category: process_creation
  product: macos

detection:
  selection:
    Image|endswith: '/openssl'
    CommandLine|contains|all:
      - 'enc'
      - '-d'
  selection_gpg:
    Image|endswith: '/gpg'
    CommandLine|contains: '--decrypt'
  condition: 1 of selection*

falsepositives:
  - Legitimate use of openssl or gpg for decrypting configuration files or backups by administrators.

level: medium

Related sub-techniques

Explore