Obfuscated Files or Information: Command Obfuscation

APT19 used Base64 to obfuscate executed commands.^[10]

APT32 has used the Invoke-Obfuscation framework to obfuscate their PowerShell.^[11][12][13]

Aquatic Panda has encoded PowerShell commands in Base64.^[14]

Astaroth has obfuscated and randomized parts of the JScript code it is initiating.^[15]

BackConfig has used compressed and decimal encoded VBS scripts.^[16]

BADHATCH malicious PowerShell commands can be encoded with base64.^[17]

During C0018, the threat actors used Base64 to encode their PowerShell scripts.^[18][19]

During C0021, the threat actors used encoded PowerShell commands.^[20][21]

CARROTBAT has the ability to execute obfuscated commands on the infected host.^[22]

Chimera has encoded PowerShell commands.^[23]

Cobalt Group obfuscated several scriptlets and code used on the victim’s machine, including through use of XOR and RC4.^[24][25]

ComRAT has used encryption and base64 to obfuscate its orchestrator code in the Registry. ComRAT has also used encoded PowerShell scripts.^[26][27]

Contagious Interview has obfuscated JavaScript code using Base64 and variable substitutions.^{[28][29][30][31]}

CookieMiner has used base64 encoding to obfuscate scripts on the system.^[32]

DarkWatchman has used Base64 to encode PowerShell commands.^[33]

Denis has encoded its PowerShell commands in Base64.^[13]

Emotet has obfuscated macros within malicious documents to hide the URLs hosting the malware, CMD.exe arguments, and PowerShell scripts. ^{[34][35][36][37]}

Empire has the ability to obfuscate commands using Invoke-Obfuscation.^[38]

FIN6 has used encoded PowerShell commands.^[39]

FIN7 has used fragmented strings, environment variables, standard input (stdin), and native character-replacement functionalities to obfuscate commands.^[6][40][41]

FIN8 has used environment variables and standard input (stdin) to obfuscate command-line arguments. FIN8 also obfuscates malicious macros delivered as payloads.^[6][42][43]

Fox Kitten has base64 encoded scripts to avoid detection.^[44]

During Frankenstein, the threat actors ran encoded commands from the command line.^[45]

FruitFly executes and stores obfuscated Perl scripts.^[46]

Gamaredon Group has used obfuscated or encrypted scripts.^{[47][48][49][50]}

GOLD SOUTHFIELD has executed base64 encoded PowerShell scripts on compromised hosts.^[51]

HEXANE has used Base64-encoded scripts.^[52]

IceApple can use Base64 and "junk" JavaScript code to obfuscate information.^[53]

Kimsuky has encoded malicious PowerShell scripts using Base64.^[54]

KOCTOPUS has obfuscated scripts with the BatchEncryption tool.^[55]

LazyScripter has leveraged the BatchEncryption tool to perform advanced batch script obfuscation and encoding techniques.^[55]

Leafminer obfuscated scripts that were used on victim machines.^[56]

LoudMiner has obfuscated various scripts.^[57]

Machete has used pyobfuscate, zlib compression, and base64 encoding for obfuscation. Machete has also used some visual obfuscation techniques by naming variables as combinations of letters to hinder analysis.^[58][59]

Magic Hound has used base64-encoded commands.^[60][61]

Medusa Group has obfuscated PowerShell scripts with Base64 encoding.^[62] Medusa Group has also obfuscated the code of dropped kernel drivers using a software known as Safengine Shielden which randomized the code through code mutations and then leveraged an embedded virtual machine interpreter to execute the code.^[63]

MuddyWater has used Daniel Bohannon’s Invoke-Obfuscation framework and obfuscated PowerShell scripts.^[64][12] The group has also used other obfuscation methods, including Base64 obfuscation of VBScripts and PowerShell commands.^{[64][65][66][67][68][69][70]}

Netwalker's PowerShell script has been obfuscated with multiple layers including base64 and hexadecimal encoding and XOR-encryption, as well as obfuscated PowerShell functions and variables.^[71][72]

During Operation CuckooBees, the threat actors executed an encoded VBScript file.^[73]

During Operation Wocao, threat actors executed PowerShell commands which were encoded or compressed using Base64, zlib, and XOR.^[74]

Patchwork has obfuscated a script with Crypto Obfuscator.^[75]

Play has used Base64-encoded PowerShell scripts for post exploit activities on compromised hosts.^[76]

PoetRAT has pyminifier to obfuscate scripts.^[77]

PowerPunch can use Base64-encoded scripts.^[48]

PowerSploit contains a collection of ScriptModification modules that compress and encode scripts and payloads.^[78][79]

POWERSTATS uses character replacement, PowerShell environment variables, and XOR encoding to obfuscate code. POWERSTATS's backdoor code is a multi-layer obfuscated, encoded, and compressed blob. ^[65][80] POWERSTATS has used PowerShell code with custom string obfuscation ^[81]

QakBot can use obfuscated and encoded scripts.^[82][83]

QUADAGENT was likely obfuscated using Invoke-Obfuscation.^[84][12]

RedLine Stealer has obfuscated scripts within text files used in execution.^[85]

The PowerShell script with the RogueRobin payload was obfuscated using the COMPRESS technique in Invoke-Obfuscation.^[86][12]

Sandworm Team has used ROT13 encoding, AES encryption and compression with the zlib library for their Python-based backdoor.^[87]

Sardonic PowerShell scripts can be encrypted with RC4 and compressed using Gzip.^[88]

During SharePoint ToolShell Exploitation, threat actors executed Base64-encoded PowerShell commands.^{[89][90][91][92][93]}

SHARPSTATS has used base64 encoding and XOR to obfuscate PowerShell scripts.^[81]

Sibot has obfuscated scripts used in execution.^[94]

Sidewinder has used base64 encoding for scripts.^[95][96]

Silence has used environment variable string substitution for obfuscation.^[97]

SQLRat has used a character insertion obfuscation technique, making the script appear to contain Chinese characters.^[98]

TA505 has used base64 encoded PowerShell commands.^[99][100]

TA551 has used obfuscated variable names in a JavaScript configuration file.^[101]

Turla has used encryption (including salted 3DES via PowerSploit's Out-EncryptedScript.ps1), random variable names, and base64 encoding to obfuscate PowerShell commands and payloads.^[102]

Ursnif droppers execute base64 encoded PowerShell commands.^[103]

Wizard Spider used Base64 encoding to obfuscate an Empire service and PowerShell commands.^[104][105]

XORIndex Loader has obfuscated strings using ASCII buffers and TextDecoder.^[106]

Zeus Panda obfuscates the macro commands in its initial payload.^[107]

Consider utilizing the Antimalware Scan Interface (AMSI) on Windows 10+ to analyze commands after being processed/interpreted.

On Windows 10+, enable Attack Surface Reduction (ASR) rules to block execution of potentially obfuscated scripts.^[108]