T1027 Obfuscated Files or Information — Detection & Response

Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses, whether hiding a malicious payload from AV signature scanning, defeating email gateway inspection, or camouflaging command execution from EDR and script logging.

Obfuscation is nearly universal in modern intrusions because it directly defeats the static-analysis layer of most defenses. Initial-access payloads arrive HTML-smuggled inside SVG or HTML attachments that reassemble a ZIP or ISO in the browser, sidestepping email gateway scanning entirely (used heavily by Qakbot, Pikabot, and multiple ransomware affiliates). PowerShell and cmd command lines are obfuscated with base64 encoding, string concatenation, format-string reordering, and character substitution (Invoke-Obfuscation, PSAmsi bypass patterns). Second-stage payloads are packed with commercial and custom packers (UPX, Themida, VMProtect), and increasingly stored fileless — in registry values, WMI class properties, or scheduled task actions — to defeat disk-based scanning. Steganographic techniques hide payloads inside PNG/JPEG images or, more recently, inside benign-looking JSON blobs served from CDNs.