Clankerusecase
MITRE ATT&CK detection coverage
 ← Back to main site
Home/ MITRE Matrix/ Defense Evasion/ T1140

T1140Deobfuscate/Decode Files or Information

T1140 — Deobfuscate/Decode Files or Information is a MITRE ATT&CK technique in the Defense Evasion tactic. Clankerusecase tracks 12 detection use cases covering it and 13 threat-intel articles citing it.

Defense Evasion
View on the matrix → Filter Detection Library MITRE official spec ↗
12Use cases
13Articles
0Sub-techniques
1Tactic

Use cases covering this technique (12)

[WEEKLY] Cross-Platform ClickFix Paste-to-Pipe Loader (UI-Parent Shell with Decode-and-Execute Payload) Internal delivery · alerting DSΣP CertUtil With Decode Argument ESCU actions · alerting P Linux Auditd Base64 Decode Files ESCU actions · hunting P [LLM] Bun spawned from npm install context executing /tmp/p*.js implant Bespoke install · alerting DSΣPDDCS [LLM] Stealer or VBS launcher dropped into .laravel_locale temp directory Bespoke install · alerting DSΣPDDCS [LLM] node process spawning bash/curl chain to fetch Velora DEX install.sh dropper Bespoke delivery · alerting DSΣPDDCS [LLM] Python spawning python -c with base64.b64decode exec (litellm .pth stage-1 launcher) Bespoke install · alerting DSΣP [LLM] GitHub Actions runner credential stealer: python3 base64-decoded payload reading /proc/<pid>/mem Bespoke actions · hunting DSPDD [LLM] XZ Utils (CVE-2024-3094) build-time backdoor extraction from disguised test corpus Bespoke install · alerting DSΣPDDCS [LLM] Non-browser process reading Chrome/Edge/Opera Login Data or Local State Bespoke actions · alerting DSΣPDDCS [LLM] Malicious tj-actions base64 payload prefix observed in process command line Bespoke exploit · alerting DSΣPDDCS [LLM] gxm-reference encrypted-payload artifacts written to disk (obfusc/mac/win/lin .enc.js) Bespoke delivery · alerting DSΣPDDCS

Articles citing this technique (13)

crit ESET takes part in Operation Endgame to disrupt Amadey and Stealc art-351
high Multiple redhat-cloud-services npm Packages compromised art-416
high Supply Chain Attack Targets Laravel-Lang Packages with Credential Stealer art-446
crit A rigged game: ScarCruft compromises gaming platform in a supply-chain attack art-500
high @velora-dex/sdk Compromised on npm: Malicious Version Drops macOS Backdoor via launchctl Persistence art-566
crit litellm: Credential Stealer Hidden in PyPI Wheel art-587
high Trivy Compromised a Second Time - Malicious v0.69.4 Release, aquasecurity/setup-trivy, aquasecurity/trivy-action GitHub Actions Compromised art-593
crit EDR killers explained: Beyond the drivers art-613
crit Sednit reloaded: Back in the trenches art-629
high 2024 in Review: The Evolution of CI/CD Security & What's Next art-674
med MuddyWater: Snakes by the riverbank art-786
crit Reconstructing the TJ Actions Changed Files GitHub Actions Compromise art-1043
crit Targeted npm dependency confusion attack caught red-handed art-2296