Clankerusecase
MITRE ATT&CK detection coverage
 ← Back to main site
Home/ MITRE Matrix/ Defense Evasion/ T1140

T1140Deobfuscate/Decode Files or Information

T1140 — Deobfuscate/Decode Files or Information is a MITRE ATT&CK technique in the Defense Evasion tactic. Clankerusecase tracks 15 detection use cases covering it and 16 threat-intel articles citing it.

Defense Evasion
View on the matrix → Filter Detection Library MITRE official spec ↗
15Use cases
16Articles
0Sub-techniques
1Tactic

Use cases covering this technique (15)

[WEEKLY] Cross-Platform ClickFix Paste-to-Pipe Loader (UI-Parent Shell with Decode-and-Execute Payload) Internal delivery · alerting DSΣPDD CertUtil With Decode Argument ESCU actions · alerting P Linux Auditd Base64 Decode Files ESCU actions · hunting P [LLM] Argamal MI_V / MI_V2 Environment Variable Stage Handoff Bespoke install · alerting DSΣPDDCS [LLM] Bun spawned from npm install context executing /tmp/p*.js implant Bespoke install · alerting DSΣPDDCS [LLM] Stealer or VBS launcher dropped into .laravel_locale temp directory Bespoke install · alerting DSΣPDDCS [LLM] Kimsuky JSE dropper: wscript -> powershell hidden + certutil -decode chain Bespoke delivery · alerting DSΣPDD [LLM] node process spawning bash/curl chain to fetch Velora DEX install.sh dropper Bespoke delivery · alerting DSΣPDDCS [LLM] Python spawning python -c with base64.b64decode exec (litellm .pth stage-1 launcher) Bespoke install · alerting DSΣPDDCS [LLM] TeamPCP Linux/Mac stdin-piped Python second stage (sys.executable -) Bespoke exploit · hunting DSPDDCS [LLM] GitHub Actions runner credential stealer: python3 base64-decoded payload reading /proc/<pid>/mem Bespoke actions · hunting DSPDD [LLM] GlassWorm invisible-Unicode decoder signature (variation-selector eval loader) in process cmdline Bespoke exploit · hunting DSΣPDD [LLM] G_Wagon dropper: node.exe spawns system tar.exe extracting from stdin (-x -f - -C) Bespoke delivery · alerting DSΣPDDCS [LLM] Non-browser process reading Chrome/Edge/Opera Login Data or Local State Bespoke actions · alerting DSΣPDDCS [LLM] Malicious tj-actions base64 payload prefix observed in process command line Bespoke exploit · alerting DSΣPDDCS

Articles citing this technique (16)

high Argamal: Malware hidden in hentai games art-137
high Multiple redhat-cloud-services npm Packages compromised art-144
high Supply Chain Attack Targets Laravel-Lang Packages with Credential Stealer art-212
crit Kimsuky targets organizations with PebbleDash-based tools art-308
crit A rigged game: ScarCruft compromises gaming platform in a supply-chain attack art-332
high @velora-dex/sdk Compromised on npm: Malicious Version Drops macOS Backdoor via launchctl Persistence art-399
crit litellm: Credential Stealer Hidden in PyPI Wheel art-423
crit Popular telnyx package compromised on PyPI by TeamPCP art-425
high Trivy Compromised a Second Time - Malicious v0.69.4 Release, aquasecurity/setup-trivy, aquasecurity/trivy-action GitHub Actions Compromised art-430
crit EDR killers explained: Beyond the drivers art-455
crit Glassworm Is Back: A New Wave of Invisible Unicode Attacks Hits Hundreds of Repositories art-468
crit Sednit reloaded: Back in the trenches art-477
high G_Wagon: npm Package Deploys Python Stealer Targeting 100+ Crypto Wallets art-604
med MuddyWater: Snakes by the riverbank art-676
crit Gotta fly: Lazarus targets the UAV sector art-734
crit Reconstructing the TJ Actions Changed Files GitHub Actions Compromise art-957