Home/ MITRE Matrix/ Defense Evasion/ T1027.013

T1027.013Encrypted/Encoded File

T1027.013 — Encrypted/Encoded File is a MITRE ATT&CK technique in the Defense Evasion tactic. Clankerusecase tracks 4 detection use cases covering it and 7 threat-intel articles citing it.

Defense Evasion

View on the matrix → Filter Detection Library MITRE official spec ↗

4Use cases

7Articles

0Sub-techniques

1Tactic

↑ Parent technique: T1027 · Obfuscated Files or Information

Use cases covering this technique (4)

Windows Obfuscated Files or Information via RAR SFX ESCU actions · hunting P [LLM] TeamPCP telnyx FetchAudio() — python subprocess running inline base64 exec Bespoke install · alerting DSΣPDD [LLM] ValleyRAT registry-resident shellcode (HKCU\Console\0|1) and MyPythonApp Run-key persistence Bespoke install · hunting DSΣP [LLM] GitHub Actions runner credential stealer: python3 base64-decoded payload reading /proc/<pid>/mem Bespoke actions · hunting DSPDD

Articles citing this technique (7)

crit Webworm: New burrowing techniques art-413

crit A rigged game: ScarCruft compromises gaming platform in a supply-chain attack art-455

crit TeamPCP Plants WAV Steganography Credential Stealer in telnyx PyPI Package art-535

high A cunning predator: How Silver Fox preys on Japanese firms this tax season art-548

high Trivy Compromised a Second Time - Malicious v0.69.4 Release, aquasecurity/setup-trivy, aquasecurity/trivy-action GitHub Actions Compromised art-552

crit LongNosedGoblin tries to sniff out governmental affairs in Southeast Asia and Japan art-728

crit PlushDaemon compromises network devices for adversary-in-the-middle attacks art-773