T1140 Deobfuscate/Decode Files or Information

T1140 Deobfuscate/Decode Files or Information

High-Level Description

Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.

One such example is the use of certutil to decode a remote access tool portable executable file that has been hidden inside a certificate file. Another example is using the Windows copy /b or type command to reassemble binary fragments into a malicious payload.

Sometimes a user's action may be required to open it for deobfuscation or decryption as part of User Execution. The user may also be required to input a password to open a password protected compressed/encrypted file that was provided by the adversary.

Kill Chain Phase

• Defense Evasion (TA0005)

Platforms: ESXi, Linux, macOS, Windows

What to Check

• Identify if Deobfuscate/Decode Files or Information technique is applicable to target environment
• Check ESXi systems for indicators of Deobfuscate/Decode Files or Information
• Check Linux systems for indicators of Deobfuscate/Decode Files or Information
• Check macOS systems for indicators of Deobfuscate/Decode Files or Information
• Assess detection coverage (1 detection strategies)

How to Test

Atomic Red Team Tests

The following tests are from Atomic Red Team and provide actionable ways to test this technique:

Atomic Test 1: Deobfuscate/Decode Files Or Information

Encode/Decode executable Upon execution a file named T1140_calc_decoded.exe will be placed in the temp folder

Supported Platforms: windows

certutil -encode #{executable} %temp%\T1140_calc.txt
certutil -decode %temp%\T1140_calc.txt %temp%\T1140_calc_decoded.exe