T1027Obfuscated Files or Information
T1027 — Obfuscated Files or Information is a MITRE ATT&CK technique in the Defense Evasion tactic. Clankerusecase tracks 47 detection use cases covering it and 246 threat-intel articles citing it.
Defense Evasion
47Use cases
246Articles
18Sub-techniques
1Tactic
Sub-techniques (18)
T1027.001 · Binary PaddingT1027.010 · Command ObfuscationT1027.004 · Compile After DeliveryT1027.015 · CompressionT1027.007 · Dynamic API ResolutionT1027.009 · Embedded PayloadsT1027.013 · Encrypted/Encoded FileT1027.011 · Fileless StorageT1027.006 · HTML SmugglingT1027.005 · Indicator Removal from ToolsT1027.018 · Invisible UnicodeT1027.016 · Junk Code InsertionT1027.012 · LNK Icon SmugglingT1027.014 · Polymorphic CodeT1027.002 · Software PackingT1027.003 · SteganographyT1027.008 · Stripped PayloadsT1027.017 · SVG Smuggling
Use cases covering this technique (47)
File hash IOCs — endpoint file/process match PowerShell encoded / obfuscated command [WEEKLY] npm/yarn/pnpm Install-Hook Spawn → Credential-Store Read or Worm-Payload Drop in node_modules [WEEKLY] Package-install lifecycle script harvests local credentials and beacons to a non-baselined domain [WEEKLY] Package Manager Install Hook Spawns Scripting Interpreter Then Touches Credential Files or Egresses Off-Registry Curl Execution with Percent Encoded URL Linux Decode Base64 to Shell Linux Obfuscated Files or Information Base64 Decode Malicious PowerShell Process - Encoded Command Powershell Fileless Script Contains Base64 Encoded Content Wermgr Process Create Executable File Windows Snake Malware File Modification Crmlog Windows TinyCC Shellcode Execution Cisco Secure Firewall - Lumma Stealer Activity Cisco Secure Firewall - Repeated Malware Downloads Cisco Secure Firewall - Snort Rule Triggered Across Multiple Hosts [LLM] Talos prevalent malware hash dropped to disk (DeviceFileEvents pivot) [LLM] Write of unattend.xml or ReAgent.xml to system recovery partition (GreatXML staging) [LLM] SPECTRALVIPER known-bad SHA1 observed on disk or in process [LLM] Miasma stealer payload SHA256 match on disk or in execution Article-specific behavioural hunt — Hypotheses, telemetry, and human judgment: Inside Cisco Talos Threat Hunting [LLM] PowerShell Invoke-WebRequest dropping script.ps1 to user AppData (KongTuke stage-2) [LLM] Literal PraisonAI sandbox-escape signature: `print.__self__` + builtins dict access [LLM] TamperedChef scheduled-task persistence via task.xml + obfuscated JS (appsuite-print.js) [LLM] On-disk presence of malicious @opensearch-project/opensearch payload SHA256 [LLM] node-ipc stealer __ntw=1 environment marker in process command line Article-specific behavioural hunt — Kimsuky targets organizations with PebbleDash-based tools [LLM] TeamPCP Mini Shai-Hulud stealer payload hash match (SHA256/SHA1) [LLM] Mini Shai-Hulud router_init.js dropped at npm package root in node_modules [LLM] Mini Shai-Hulud Wave 4 (TanStack/TeamPCP) worm payload file created in node_modules [LLM] Known-malicious bw_setup.js / bw1.js SHA256 dropped under @bitwarden/cli [LLM] lightning PyPI compromise artifacts: start.py / router_runtime.js write [LLM] Mini Shai-Hulud payload file drop: setup.mjs/execution.js by hash & size in node_modules Article-specific behavioural hunt — axios Compromised on npm - Malicious Versions Drop Remote Access Trojan [LLM] Python spawning python -c with base64.b64decode exec (litellm .pth stage-1 launcher) [LLM] ForceMemo: init.json persistence file or i.js loader dropped by Python in user home root Article-specific behavioural hunt — Glassworm Strikes Popular React Native Phone Number Packages [LLM] GlassWorm invisible-Unicode decoder signature (variation-selector eval loader) in process cmdline [LLM] Prompt-injection markers (base64, Unicode tags, 'ignore previous instructions') in SKILL.md content Article-specific behavioural hunt — Fake Clawdbot VS Code Extension Installs ScreenConnect RAT Article-specific behavioural hunt — G_Wagon: npm Package Deploys Python Stealer Targeting 100+ Crypto Wallets [LLM] G_Wagon npm postinstall spawns python with stdin pipe (fileless payload exec) [LLM] G_Wagon Python runtime drop into npm cache with lib_core/renderer or python_runtime paths Article-specific behavioural hunt — LongNosedGoblin tries to sniff out governmental affairs in Southeast Asia and Ja [LLM] Bun/Node executing the Sha1-Hulud worm payload (setup_bun.js / bun_environment.js) [LLM] Execution / write of ESET APT Q2-Q3 2025 known-bad SHA256 payload [LLM] cups-browsed writing new PPD or config under /etc/cups or /var/cache/cupsArticles citing this technique (246)
high Malicious npm Campaign Steals SSH Keys, API Tokens, Cloud Credentials, and Wallet Secrets art-26
high A tale of two eras art-40
high Miasma and Hades Are Spreading Now: Detect Them on Developer Machines with Suspicious Files art-45
crit CISA KEV: CVE-2026-50751 — Check Point Security Gateway Improper Authentication Vulnerability art-111
crit [GHSA / CRITICAL] GHSA-jpvj-wpmj-h7rv: Supply chain compromise via malicious @cap-js/openapi art-123
high Node-gyp Supply Chain Compromise: A Self-Propagating npm Worm That Hides in binding.gyp art-130
high Miasma supply chain attack: malicious code found in @redhat-cloud-services npm packages art-159
crit Cloud Atlas activity in the second half of 2025 and early 2026: new tools and a new payload art-219
high GitHub breached via a malicious VS Code extension: why developer devices are the real target art-238
crit The AntV Supply Chain Campaign Expands: Microsoft's `durabletask` PyPI Package Compromised art-248
high Microsoft's durabletask package on PyPi Compromised. Mini Shai Hulud attacks again... again! art-254
crit From PDB strings to MaaS: Tracking a commodity BadIIS ecosystem used by Chinese-speaking threat art-265
crit [GHSA / CRITICAL] GHSA-wx9m-wx4f-4cmg: Malicious dropper in mistralai 2.4.6 PyPI package art-272
crit Malicious node-ipc versions published to npm in suspected maintainer account compromise art-284
crit Mini Shai-Hulud Is Back: npm Worm Hits over 160 Packages, including Mistral and Tanstack art-315
high "A Mini Shai-Hulud Has Appeared": Bun-Based Stealer Hits SAP @cap-js and mbt npm Packages art-348
high Malicious Release of elementary-data PyPI Package Steals Cloud Credentials from Data Engineers art-352
high CanisterWorm: How a Self-Propagating npm Worm Is Spreading Backdoors Across the Ecosystem art-429
crit Malicious Polymarket Bot Hides in Hijacked dev-protocol GitHub Org and Steals Wallet Keys art-433
crit ForceMemo: Hundreds of GitHub Python Repos Compromised via Account Takeover and Force-Push art-434
crit Glassworm Is Back: A New Wave of Invisible Unicode Attacks Hits Hundreds of Repositories art-468
high DRILLAPP: new backdoor targeting Ukrainian entities with possible links to Laundry Bear art-470
high 20+ Popular NPM Packages Compromised (Chalk, Debug, Strip-ANSI, Color-Convert, Wrap-ANSI...) art-537
high How Harden Runner Detected the Sha1-Hulud Supply Chain Attack in CNCF's Backstage Repository art-652
high Security Advisory: Critical RCE Vulnerabilities in React Server Components (CVE-2025-55182) art-673
crit CISA KEV: CVE-2013-3893 — Microsoft Internet Explorer Resource Management Errors Vulnerability art-822
crit CISA KEV: CVE-2025-53770 — Microsoft SharePoint Deserialization of Untrusted Data Vulnerability art-844
crit CISA KEV: CVE-2024-11182 — MDaemon Email Server Cross-Site Scripting (XSS) Vulnerability art-902
crit CISA KEV: CVE-2025-4428 — Ivanti Endpoint Manager Mobile (EPMM) Code Injection Vulnerability art-903
crit CISA KEV: CVE-2025-32756 — Fortinet Multiple Products Stack-Based Buffer Overflow Vulnerability art-906
crit CISA KEV: CVE-2025-24054 — Microsoft Windows NTLM Hash Disclosure Spoofing Vulnerability art-929
crit CISA KEV: CVE-2021-20035 — SonicWall SMA100 Appliances OS Command Injection Vulnerability art-933
crit CISA KEV: CVE-2025-24472 — Fortinet FortiOS and FortiProxy Authentication Bypass Vulnerability art-956
crit CISA KEV: CVE-2025-22224 — VMware ESXi and Workstation TOCTOU Race Condition Vulnerability art-979
crit CISA KEV: CVE-2021-44207 — Acclaim Systems USAHERDS Use of Hard-Coded Credentials Vulnerability art-1044
crit CISA KEV: CVE-2024-55956 — Cleo Multiple Products Unauthenticated File Upload Vulnerability art-1051
crit CISA KEV: CVE-2024-49039 — Microsoft Windows Task Scheduler Privilege Escalation Vulnerability art-1089
crit CISA KEV: CVE-2024-8963 — Ivanti Cloud Services Appliance (CSA) Path Traversal Vulnerability art-1140
crit CISA KEV: CVE-2024-8190 — Ivanti Cloud Services Appliance OS Command Injection Vulnerability art-1153
crit CISA KEV: CVE-2024-38213 — Microsoft Windows SmartScreen Security Feature Bypass Vulnerability art-1185
crit CISA KEV: CVE-2024-38178 — Microsoft Windows Scripting Engine Memory Corruption Vulnerability art-1186
crit The XZ backdoor CVE-2024-3094 art-1266