Obfuscated Files or Information: Command Obfuscation

APT19 used Base64 to obfuscate executed commands.^[10]

APT32 has used the Invoke-Obfuscation framework to obfuscate their PowerShell.^[11][12][13]

Aquatic Panda has encoded PowerShell commands in Base64.^[14]

Astaroth has obfuscated and randomized parts of the JScript code it is initiating.^[15]

BackConfig has used compressed and decimal encoded VBS scripts.^[16]

BADHATCH malicious PowerShell commands can be encoded with base64.^[17]

During C0018, the threat actors used Base64 to encode their PowerShell scripts.^[18][19]

During C0021, the threat actors used encoded PowerShell commands.^[20][21]

CARROTBAT has the ability to execute obfuscated commands on the infected host.^[22]

Chimera has encoded PowerShell commands.^[23]

Cobalt Group obfuscated several scriptlets and code used on the victim’s machine, including through use of XOR and RC4.^[24][25]

ComRAT has used encryption and base64 to obfuscate its orchestrator code in the Registry. ComRAT has also used encoded PowerShell scripts.^[26][27]

CookieMiner has used base64 encoding to obfuscate scripts on the system.^[28]

DarkWatchman has used Base64 to encode PowerShell commands.^[29]

Denis has encoded its PowerShell commands in Base64.^[13]

Emotet has obfuscated macros within malicious documents to hide the URLs hosting the malware, CMD.exe arguments, and PowerShell scripts. ^{[30][31][32][33]}

Empire has the ability to obfuscate commands using Invoke-Obfuscation.^[34]

FIN6 has used encoded PowerShell commands.^[35]

FIN7 has used fragmented strings, environment variables, standard input (stdin), and native character-replacement functionalities to obfuscate commands.^[6][36][37]

FIN8 has used environment variables and standard input (stdin) to obfuscate command-line arguments. FIN8 also obfuscates malicious macros delivered as payloads.^[6][38][39]

Fox Kitten has base64 encoded scripts to avoid detection.^[40]

During Frankenstein, the threat actors ran encoded commands from the command line.^[41]

FruitFly executes and stores obfuscated Perl scripts.^[42]

Gamaredon Group has used obfuscated or encrypted scripts.^[43][44]

GOLD SOUTHFIELD has executed base64 encoded PowerShell scripts on compromised hosts.^[45]

HEXANE has used Base64-encoded scripts.^[46]

IceApple can use Base64 and "junk" JavaScript code to obfuscate information.^[47]

KOCTOPUS has obfuscated scripts with the BatchEncryption tool.^[48]

LazyScripter has leveraged the BatchEncryption tool to perform advanced batch script obfuscation and encoding techniques.^[48]

Leafminer obfuscated scripts that were used on victim machines.^[49]

LoudMiner has obfuscated various scripts.^[50]

Machete has used pyobfuscate, zlib compression, and base64 encoding for obfuscation. Machete has also used some visual obfuscation techniques by naming variables as combinations of letters to hinder analysis.^[51][52]

Magic Hound has used base64-encoded commands.^[53][54]

MuddyWater has used Daniel Bohannon’s Invoke-Obfuscation framework and obfuscated PowerShell scripts.^[55][12] The group has also used other obfuscation methods, including Base64 obfuscation of VBScripts and PowerShell commands.^{[55][56][57][58][59][60][61]}

Netwalker's PowerShell script has been obfuscated with multiple layers including base64 and hexadecimal encoding and XOR-encryption, as well as obfuscated PowerShell functions and variables.^[62][63]

During Operation CuckooBees, the threat actors executed an encoded VBScript file.^[64]

During Operation Wocao, threat actors executed PowerShell commands which were encoded or compressed using Base64, zlib, and XOR.^[65]

Patchwork has obfuscated a script with Crypto Obfuscator.^[66]

Play has used Base64-encoded PowerShell scripts for post exploit activities on compromised hosts.^[67]

PoetRAT has pyminifier to obfuscate scripts.^[68]

PowerPunch can use Base64-encoded scripts.^[44]

PowerSploit contains a collection of ScriptModification modules that compress and encode scripts and payloads.^[69][70]

POWERSTATS uses character replacement, PowerShell environment variables, and XOR encoding to obfuscate code. POWERSTATS's backdoor code is a multi-layer obfuscated, encoded, and compressed blob. ^[56][71] POWERSTATS has used PowerShell code with custom string obfuscation ^[72]

QakBot can use obfuscated and encoded scripts.^[73][74]

QUADAGENT was likely obfuscated using Invoke-Obfuscation.^[75][12]

The PowerShell script with the RogueRobin payload was obfuscated using the COMPRESS technique in Invoke-Obfuscation.^[76][12]

Sandworm Team has used ROT13 encoding, AES encryption and compression with the zlib library for their Python-based backdoor.^[77]

Sardonic PowerShell scripts can be encrypted with RC4 and compressed using Gzip.^[78]

SHARPSTATS has used base64 encoding and XOR to obfuscate PowerShell scripts.^[72]

Sibot has obfuscated scripts used in execution.^[79]

Sidewinder has used base64 encoding for scripts.^[80][81]

Silence has used environment variable string substitution for obfuscation.^[82]

SQLRat has used a character insertion obfuscation technique, making the script appear to contain Chinese characters.^[83]

TA505 has used base64 encoded PowerShell commands.^[84][85]

TA551 has used obfuscated variable names in a JavaScript configuration file.^[86]

Turla has used encryption (including salted 3DES via PowerSploit's Out-EncryptedScript.ps1), random variable names, and base64 encoding to obfuscate PowerShell commands and payloads.^[87]

Ursnif droppers execute base64 encoded PowerShell commands.^[88]

Wizard Spider used Base64 encoding to obfuscate an Empire service and PowerShell commands.^[89][90]

Zeus Panda obfuscates the macro commands in its initial payload.^[91]

Consider utilizing the Antimalware Scan Interface (AMSI) on Windows 10+ to analyze commands after being processed/interpreted.

On Windows 10+, enable Attack Surface Reduction (ASR) rules to block execution of potentially obfuscated scripts.^[92]