Detecting obfuscated files or information (T1027)

What is obfuscated files or information (T1027)?

Obfuscated files or information (T1027) is a MITRE ATT&CK® defense evasion technique where adversaries make their payloads, scripts, and commands difficult to analyze or detect by encoding, encrypting, or structurally obscuring them. The goal is to prevent security tools from recognizing malicious content through static signature matching or plain-text inspection, making an attack's components look like noise until the moment they execute.

Obfuscation is not a single action. It is a toolkit of methods ranging from simple Base64 encoding of PowerShell commands to sophisticated software packing that changes a binary's byte structure entirely. Log360 maps 60+ pre-built correlation rules to T1027, targeting the execution-time signals and structural patterns that remain detectable even when the payload content is hidden.

How attackers use obfuscation

Obfuscation is effective because most security tools perform pattern matching against known-bad content. If the content is encoded, the pattern does not match. Attackers apply obfuscation at multiple layers of their toolchain:

1. PowerShell command obfuscation: Attackers encode PowerShell commands in Base64 and invoke them with powershell -enc [base64string], bypassing script-based detection rules that look for plain-text keywords like "IEX", "DownloadString", or "Invoke-Mimikatz". Tools like Invoke-Obfuscation automate this process, producing multiple encoding variants from a single malicious command.
2. Compile-after-delivery: Instead of delivering a precompiled malicious executable, attackers deliver source code or an intermediate representation (such as C# code) and compile it on the victim machine using legitimate system utilities like csc.exe (the .NET C# compiler) or Add-Type in PowerShell. This bypasses file-based AV scanning because no malicious binary exists until execution.
3. Software packing: Packers compress and encrypt executable code so the binary on disk has a different byte structure from its in-memory execution form. Standard AV signatures match the packed binary, not the unpacked payload. Log360 detects packing indicators through behavioral analysis of the unpacking process rather than the packed file itself.
4. Steganography: Malicious payloads are hidden within images, audio files, or documents. The carrier file appears legitimate and passes standard security scans. The attacker uses a secondary process to extract and execute the embedded payload.
5. Command-line character manipulation: Attackers insert special characters, environment variable references, or string formatting operations into command-line arguments to break signature pattern matching. A command like p^o^w^e^r^s^h^e^l^l invokes PowerShell while defeating regex patterns looking for "powershell".

Sub-techniques and variants

MITRE ATT&CK documents several sub-techniques under T1027, each requiring different detection logic:

• T1027.001 — Binary padding: Adding null bytes or irrelevant data to a binary to change its hash value, defeating hash-based detection controls.
• T1027.002 — Software packing: Using commercial or custom packers to compress and encrypt the executable payload, causing the on-disk binary to appear different from the in-memory execution form.
• T1027.003 — Steganography: Embedding malicious code within image, audio, or document files to hide payload delivery within legitimate-looking file transfers.
• T1027.004 — Compile after delivery: Delivering source code or intermediate representations and compiling them on the victim machine using csc.exe, Add-Type, or similar utilities to bypass file-based scanning.
• T1027.009 — Embedded payloads: Hiding executable payloads inside documents, archives, or data files that extract and execute at runtime.
• T1027.010 — Command obfuscation: Manipulating command-line syntax, using string concatenation, environment variables, or special character insertion to defeat command-line pattern matching.

Detection indicators for T1027

T1027 detection requires behavioral analysis at execution time rather than static analysis of files on disk, because the obfuscated form of a payload does not resemble the malicious content it conceals. Key indicator categories:

PowerShell encoded command execution

Event ID 4688 with command-line logging enabled captures the raw PowerShell invocation arguments. The presence of -enc, -e, -encodedcommand, or long Base64 strings in PowerShell arguments is a reliable obfuscation indicator. Log360's Invoke-Obfuscation detection rules specifically target command patterns produced by common obfuscation frameworks.

Script block logging (Event ID 4104)

PowerShell Script Block Logging captures the deobfuscated content of every PowerShell block at execution time, regardless of how the original command was encoded. This is the most reliable T1027 detection primitive — it surfaces the actual malicious content even when every other encoding layer succeeds. Log360 correlates Event ID 4104 content against known-bad patterns from Invoke-Obfuscation variants, encoded download cradles, and shellcode runners.

Dynamic compilation artefacts

Compile-after-delivery attacks produce characteristic artefacts: csc.exe or vbc.exe spawned by unexpected parents (PowerShell, Office, browsers), temporary .cs or .vb source files in user directories, and Sysmon Event ID 7 showing new .NET assemblies loaded by script hosts. Log360's Dynamic CSharp Compile Artefact rule targets this pattern directly.

Packed binary behavioral indicators

Software packers produce characteristic runtime behavior: self-modifying code, memory allocation with write-execute permissions, and process image mismatches between the on-disk file and the in-memory loaded image. Sysmon Event ID 8 (CreateRemoteThread) and unusual memory access patterns associated with unpacking routines are detectable through Log360's behavioral correlation rules.

Log360 detection rules for T1027

Log360 ships with 60+ pre-built correlation rules directly mapped to Obfuscated files or information (T1027). Rules target obfuscation mechanics rather than payload content, providing detection that remains effective across encoding variants and new obfuscation tools:

Investigation steps

When Log360 fires a T1027 obfuscation alert, follow this sequence to decode the payload, identify the attacker's intent, and scope the impact:

1. Retrieve the script block logging content: Pull Event ID 4104 records from the affected host for the alert timeframe. PowerShell Script Block Logging captures the deobfuscated payload regardless of how it was encoded in transit, this is the fastest path to understanding what the obfuscated command actually did.
2. Decode the encoded command-line manually if needed: If script block logging is not available, extract the Base64 string from Event ID 4688 and decode it with [System.Text.Encoding]::Unicode.GetString([System.Convert]::FromBase64String('[string]')). This reveals the actual PowerShell command that was executed.
3. Identify the parent process and delivery chain: Trace the parent process of the PowerShell or compilation activity. Office applications, browsers, and email clients as PowerShell parents indicate macro or browser-based delivery. Trace the chain to identify the initial access vector.
4. Check for secondary payload execution: Obfuscation is typically a delivery layer, not the final payload. After decoding, identify what the obfuscated command did: downloaded a file, injected code, created a scheduled task, or established a network connection. Pivot to investigate those secondary actions.
5. Assess network connections: Review outbound network connections from the affected host in the window around the alert. Encoded download cradles (IEX, DownloadString, Invoke-WebRequest) indicate external payload retrieval. Extract the URL and check against threat intelligence.
6. Search for compile-after-delivery artefacts: If the alert involves dynamic compilation, search for temporary .cs/.vb source files, csc.exe or vbc.exe process execution, and newly created .NET assemblies in user-writable directories.

Response playbook

• Contain the affected host: If active obfuscated payload execution is confirmed, isolate the host from the network. Obfuscated payloads are delivery mechanisms for secondary payloads — containment prevents the secondary payload from reaching out to C2 or moving laterally before it is identified.
• Collect forensic evidence: Before any remediation, capture the original encoded command-line from Event ID 4688, the decoded script block content from Event ID 4104, any dynamically compiled assemblies on disk, and the memory state of involved processes if live response is available.
• Remove delivered payloads: Delete any malicious files dropped by the obfuscated command. Hash all artefacts for threat intelligence sharing. If a compiled assembly was created, locate and remove both the source file and the compiled binary.
• Review persistence mechanisms: Obfuscated PowerShell frequently installs persistence. Check for new scheduled tasks (Event ID 4698), new services (Event ID 7045), registry run keys, and startup folder additions created around the time of the alert.
• Enable script block logging if not already active: If the alert surfaced through command-line detection rather than script block logging, prioritize enabling Event ID 4104 collection in Log360. Script block logging makes future obfuscation significantly harder to execute undetected.
• Update detection baselines: After the incident, add the decoded indicators (download URLs, C2 addresses, compiled assembly hashes) to Log360's threat intelligence and custom detection rules to catch future variants of the same campaign.

Frequently asked questions