T1140 — Deobfuscate/Decode Files or Information

Tactic: Stealth · Platforms: ESXi, Linux, macOS, Windows

Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using…

Sigma detection rules (3)

T1140 Deobfuscate/Decode Files or Information

title: T1140 Deobfuscate/Decode Files or Information
id: a6dd6f96-d71c-4ff2-94ce-77224d15b637
description: 'Detects use of built-in Windows utilities (certutil, expand, copy /b) to deobfuscate or decode a payload that was hidden or obfuscated on disk, such as decoding a certutil-hidden executable or reassembling a payload with copy /b. Tune using: ToolName, FileExtensionFilter, CommandLineRegex, TimeWindow.'
references:
  - https://attack.mitre.org/techniques/T1140
author: Shahrukh Khan
date: 2026-03-22
license: MIT
tags:
  - attack.stealth
  - attack.t1140

logsource:
  category: process_creation
  product: windows
  service: sysmon

detection:
  selection_certutil:
    Image|endswith: '\certutil.exe'
    CommandLine|contains:
      - '-decode'
      - '-decodehex'
      - '/decode'
  selection_expand:
    Image|endswith: '\expand.exe'
  selection_copyb:
    CommandLine|contains|all:
      - 'copy'
      - '/b'

  condition: 1 of selection_*

falsepositives:
  - Legitimate certificate-management use of certutil's decode functions, or administrative use of expand/copy /b for non-malicious archive or driver-cabinet extraction; verify the target file and destination path.

level: medium

T1140 Deobfuscate/Decode Files or Information

title: T1140 Deobfuscate/Decode Files or Information
id: fd460636-5aa8-4aec-9871-2c546efe5e8f
description: 'Detect Adversary Deobfuscation or Decoding of Files and Payloads. (Retargeted to the process_creation auditd telemetry that actually captures this techniques behavior; see logsource below.) Tune using: ShellProcessName, DecodeUtility, ParentProcess, ArgumentPattern.'
references:
  - https://attack.mitre.org/techniques/T1140
author: Shahrukh Khan
date: 2026-06-27
license: MIT
tags:
  - attack.stealth
  - attack.t1140

logsource:
  category: process_creation
  product: linux

detection:
  selection:
    type: EXECVE
    a0|endswith: '/base64'
    a1: '-d'
  selection_pipe:
    type: EXECVE
    a0|endswith:
      - '/bash'
      - '/sh'
    a1: '-c'
    a2|contains: 'base64 -d'

  condition: 1 of selection*

falsepositives:
  - Some legitimate deployment one-liners decode base64-encoded configs; the combination of decode-then-execute (piped directly into a shell) is the stronger, less common indicator worth prioritizing.

level: high

T1140 Deobfuscate/Decode Files or Information

title: T1140 Deobfuscate/Decode Files or Information
id: a36f764f-8c4f-4fda-800d-be77a92911e0
description: 'Detect Adversary Deobfuscation or Decoding of Files and Payloads. (Retargeted to the process_creation macOS unified-log telemetry that actually captures this techniques behavior; see logsource below.) Tune using: DecodeInterpreter, ExecutionContext, UserContext.'
references:
  - https://attack.mitre.org/techniques/T1140
author: Shahrukh Khan
date: 2026-01-03
license: MIT
tags:
  - attack.stealth
  - attack.t1140

logsource:
  category: process_creation
  product: macos

detection:
  selection:
    Image|endswith:
      - '/base64'
      - '/openssl'
      - '/python3'
    CommandLine|contains:
      - '-decode'
      - 'b64decode'
      - 'enc -d'

  condition: selection

falsepositives:
  - Legitimate scripts decode configuration data or certificates using the same utilities.

level: medium

Explore