cyberstrikeus T1140 Deobfuscate/Decode Files or Information
High-Level Description
Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
One such example is the use of certutil to decode a remote access tool portable executable file that has been hidden inside a certificate file. Another example is using the Windows copy /b or type command to reassemble binary fragments into a malicious payload.
Sometimes a user's action may be required to open it for deobfuscation or decryption as part of User Execution. The user may also be required to input a password to open a password protected compressed/encrypted file that was provided by the adversary.
Kill Chain Phase
- Defense Evasion (TA0005)
Platforms: ESXi, Linux, macOS, Windows
What to Check
- Identify if Deobfuscate/Decode Files or Information technique is applicable to target environment
- Check ESXi systems for indicators of Deobfuscate/Decode Files or Information
- Check Linux systems for indicators of Deobfuscate/Decode Files or Information
- Check macOS systems for indicators of Deobfuscate/Decode Files or Information
- Assess detection coverage (1 detection strategies)
How to Test
Atomic Red Team Tests
The following tests are from Atomic Red Team and provide actionable ways to test this technique:
Atomic Test 1: Deobfuscate/Decode Files Or Information
Encode/Decode executable Upon execution a file named T1140_calc_decoded.exe will be placed in the temp folder
Supported Platforms: windows
certutil -encode #{executable} %temp%\T1140_calc.txt
certutil -decode %temp%\T1140_calc.txt %temp%\T1140_calc_decoded.exe
Atomic Test 2: Certutil Rename and Decode
Rename certutil and decode a file. This is in reference to latest research by FireEye here
Supported Platforms: windows
copy %windir%\system32\certutil.exe %temp%\tcm.tmp
%temp%\tcm.tmp -encode #{executable} %temp%\T1140_calc2.txt
%temp%\tcm.tmp -decode %temp%\T1140_calc2.txt %temp%\T1140_calc2_decoded.exe
Atomic Test 3: Base64 decoding with Python
Use Python to decode a base64-encoded text string and echo it to the console
Supported Platforms: linux, macos
ENCODED=$(python3 -c 'import base64;enc=base64.b64encode("#{message}".encode());print(enc.decode())')
python3 -c "import base64;dec=base64.b64decode(\"$ENCODED\");print(dec.decode())"
python3 -c "import base64 as d;dec=d.b64decode(\"$ENCODED\");print(dec.decode())"
python3 -c "from base64 import b64decode;dec=b64decode(\"$ENCODED\");print(dec.decode())"
python3 -c "from base64 import b64decode as d;dec=d(\"$ENCODED\");print(dec.decode())"
echo $ENCODED | python3 -c "import base64,sys;dec=base64.b64decode(sys.stdin.read());print(dec.decode())"
echo $ENCODED > #{encoded_file} && python3 -c "import base64;dec=base64.b64decode(open('#{encoded_file}').read());print(dec.decode())"
Dependencies:
- Python must be present
Atomic Test 4: Base64 decoding with Perl
Use Perl to decode a base64-encoded text string and echo it to the console
Supported Platforms: linux, macos
ENCODED=$(perl -e "use MIME::Base64;print(encode_base64('#{message}'));")
perl -le "use MIME::Base64;print(decode_base64('$ENCODED'));"
echo $ENCODED | perl -le 'use MIME::Base64;print(decode_base64(<STDIN>));'
echo $ENCODED > #{encoded_file} && perl -le 'use MIME::Base64;open($f,"<","#{encoded_file}");print(decode_base64(<$f>));'
Dependencies:
- Perl must be present
Atomic Test 5: Base64 decoding with shell utilities
Use common shell utilities to decode a base64-encoded text string and echo it to the console
Supported Platforms: linux, macos
ENCODED=$(echo '#{message}' | base64)
printf $ENCODED | base64 -d
echo $ENCODED | base64 -d
echo $(echo $ENCODED) | base64 -d
echo $ENCODED > #{encoded_file} && base64 -d #{encoded_file}
echo $ENCODED > #{encoded_file} && base64 -d < #{encoded_file}
echo $ENCODED > #{encoded_file} && cat #{encoded_file} | base64 -d
echo $ENCODED > #{encoded_file} && cat < #{encoded_file} | base64 -d
bash -c "{echo,\"$(echo $ENCODED)\"}|{base64,-d}"
Manual Testing
If Atomic Red Team tests are not applicable, manually verify the technique by:
Identify Attack Surface: Determine if the target environment is susceptible to Deobfuscate/Decode Files or Information by examining the target platforms (ESXi, Linux, macOS).
Assess Existing Defenses: Review whether mitigations for T1140 are in place. If defenses are absent or misconfigured, this technique may be exploitable.
Execute Test: Use tools and methods described in the MITRE ATT&CK page and external references below.
Remediation Guide
No specific mitigations documented for this technique.
Detection
Detect Adversary Deobfuscation or Decoding of Files and Payloads
Risk Assessment
| Finding | Severity | Impact |
|---|---|---|
| Deobfuscate/Decode Files or Information technique applicable | Medium | Defense Evasion |
CWE Categories
| CWE ID | Title |
|---|---|
| CWE-693 | Protection Mechanism Failure |