Obfuscated Files or Information

Adversaries may attempt to make payloads difficult to discover or analyze by encoding, encrypting, or obfuscating contents.

Cobalt Strike beacons often use XOR encoding and base64 to obfuscate their payloads, evading signature-based detection.

• Behavior-based detection
• Sandboxing and dynamic analysis
• Memory scanning
• Machine learning detection models

• Detect encoding patterns in scripts
• Monitor for suspicious encoding operations
• Analyze entropy of files
• Behavioral analysis of execution