Techniques › T1140 › AN0767
AN0767 Analytic 0767
Windows · attack.mitre.org · ATT&CK Enterprise v19.2
<p>An adversary leverages built-in tools such as certutil.exe, powershell.exe, or copy.exe to decode, reassemble, or extract hidden malicious content from obfuscated containers or encoded formats. The decoding utility often spawns shortly after file staging or download and may be chained with script interpreters or further payload execution.</p>
- Detects
- T1140 Deobfuscate/Decode Files or Information
- Part of
- DET0275 Detect Adversary Deobfuscation or Decoding of Files and Payloads
Log sources and channels
Exactly as MITRE states them in x_mitre_log_source_references. Where a channel is vague, it is vague in the source; kevmap does not tidy it.
| Log source | Channel | Data component |
|---|---|---|
| WinEventLog:Sysmon | EventCode=1 | DC0032 Process Creation |
| WinEventLog:Sysmon | EventCode=11 | DC0039 File Creation |
| WinEventLog:Sysmon | EventCode=10 | DC0035 Process Access |
Mutable elements
Parameters MITRE marks as environment-specific. These are the knobs you are expected to tune; they are why an analytic is not a rule.
| Field | Description |
|---|---|
ToolName | May vary across environments (e.g., certutil, powershell, copy, expand, 7zip) |
FileExtensionFilter | Targets may use .txt, .cer, .enc, .b64, .zip, etc. to disguise payloads |
CommandLineRegex | Command syntax varies between base64 decoding, copy /b, and expand switches |
TimeWindow | Deobfuscation typically follows staging/download within a short timeframe |
KEV CVEs whose mapped technique this analytic detects
| CVE | Vendor / product | State |
|---|---|---|
| CVE-2021-40539 | Zoho ManageEngine | Mapped |
| CVE-2021-44077 | Zoho ManageEngine ServiceDesk Plus (SDP) / SupportCenter Plus | Mapped |