T1027
Obfuscated Files or Information
Adversaries may attempt to make payloads difficult to discover or analyze by encoding, encrypting, or obfuscating contents.
ATT&CK / Defense Evasion
Cobalt Strike beacons often use XOR encoding and base64 to obfuscate their payloads, evading signature-based detection.
Defense strategies
- Behavior-based detection
- Sandboxing and dynamic analysis
- Memory scanning
- Machine learning detection models
Detection methods
- Detect encoding patterns in scripts
- Monitor for suspicious encoding operations
- Analyze entropy of files
- Behavioral analysis of execution
D3FEND mappings
1