Clankerusecase
MITRE ATT&CK detection coverage
 ← Back to main site
Home/ MITRE Matrix/ Defense Evasion/ T1140

T1140Deobfuscate/Decode Files or Information

T1140 — Deobfuscate/Decode Files or Information is a MITRE ATT&CK technique in the Defense Evasion tactic. Clankerusecase tracks 15 detection use cases covering it and 16 threat-intel articles citing it.

Defense Evasion
View on the matrix → Filter Detection Library MITRE official spec ↗
15Use cases
16Articles
0Sub-techniques
1Tactic

Use cases covering this technique (15)

[WEEKLY] Cross-Platform ClickFix Paste-to-Pipe Loader (UI-Parent Shell with Decode-and-Execute Payload) Internal delivery · alerting DSΣP CertUtil With Decode Argument ESCU actions · alerting P Linux Auditd Base64 Decode Files ESCU actions · hunting P [LLM] BusySnake NSIS dropper: pnx.exe injected from Temp\ns*.tmp staging folder Bespoke install · alerting DSΣPDDCS [LLM] LoLBin abuse: certutil decode/urlcache, bitsadmin transfer, wmic process-call-create Bespoke install · hunting DSΣPDDCS [LLM] Bun spawned from npm install context executing /tmp/p*.js implant Bespoke install · alerting DSΣPDDCS [LLM] Stealer or VBS launcher dropped into .laravel_locale temp directory Bespoke install · alerting DSΣPDDCS [LLM] node process spawning bash/curl chain to fetch Velora DEX install.sh dropper Bespoke delivery · alerting DSΣPDDCS [LLM] Python spawning python -c with base64.b64decode exec (litellm .pth stage-1 launcher) Bespoke install · alerting DSΣP [LLM] TeamPCP Linux/Mac stdin-piped Python second stage (sys.executable -) Bespoke exploit · hunting DSPDDCS [LLM] GitHub Actions runner credential stealer: python3 base64-decoded payload reading /proc/<pid>/mem Bespoke actions · hunting DSPDD [LLM] XZ Utils (CVE-2024-3094) build-time backdoor extraction from disguised test corpus Bespoke install · alerting DSΣPDDCS [LLM] Non-browser process reading Chrome/Edge/Opera Login Data or Local State Bespoke actions · alerting DSΣPDDCS [LLM] Malicious tj-actions base64 payload prefix observed in process command line Bespoke exploit · alerting DSΣPDDCS [LLM] gxm-reference encrypted-payload artifacts written to disk (obfusc/mac/win/lin .enc.js) Bespoke delivery · alerting DSΣPDDCS

Articles citing this technique (16)

crit Armored Likho digging a snake pit: inside the covert BusySnake Stealer campaign art-250
crit Missed incidents, persistent threats, and response gaps: Insights from compromise assessment projects art-265
crit ESET takes part in Operation Endgame to disrupt Amadey and Stealc art-301
high Multiple redhat-cloud-services npm Packages compromised art-370
high Supply Chain Attack Targets Laravel-Lang Packages with Credential Stealer art-400
crit A rigged game: ScarCruft compromises gaming platform in a supply-chain attack art-455
high @velora-dex/sdk Compromised on npm: Malicious Version Drops macOS Backdoor via launchctl Persistence art-521
crit litellm: Credential Stealer Hidden in PyPI Wheel art-545
crit Popular telnyx package compromised on PyPI by TeamPCP art-547
high Trivy Compromised a Second Time - Malicious v0.69.4 Release, aquasecurity/setup-trivy, aquasecurity/trivy-action GitHub Actions Compromised art-552
crit EDR killers explained: Beyond the drivers art-577
crit Sednit reloaded: Back in the trenches art-596
high 2024 in Review: The Evolution of CI/CD Security & What's Next art-641
med MuddyWater: Snakes by the riverbank art-756
crit Reconstructing the TJ Actions Changed Files GitHub Actions Compromise art-1020
crit Targeted npm dependency confusion attack caught red-handed art-2273