Techniques › T1140 › AN0768
AN0768 Analytic 0768
Linux · attack.mitre.org · ATT&CK Enterprise v19.2
<p>The adversary uses native utilities like base64, gzip, tar, or openssl to decode, decompress, or decrypt files that were previously staged or downloaded. These tools may be chained with curl/wget and executed via bash/zsh, often to extract an embedded payload or reverse shell script.</p>
- Detects
- T1140 Deobfuscate/Decode Files or Information
- Part of
- DET0275 Detect Adversary Deobfuscation or Decoding of Files and Payloads
Log sources and channels
Exactly as MITRE states them in x_mitre_log_source_references. Where a channel is vague, it is vague in the source; kevmap does not tidy it.
| Log source | Channel | Data component |
|---|---|---|
| auditd:SYSCALL | bash/zsh of base64, tar, gzip, or openssl immediately after file write | DC0064 Command Execution |
Mutable elements
Parameters MITRE marks as environment-specific. These are the knobs you are expected to tune; they are why an analytic is not a rule.
| Field | Description |
|---|---|
ShellProcessName | Shell interpreter may vary (bash, zsh, dash, sh) |
DecodeUtility | May include base64, openssl, gunzip, tar, uudecode |
ParentProcess | Expected parent process may vary in attacker chain (e.g., curl, bash, ssh) |
ArgumentPattern | Detection regex should support flexible patterning of decode switches |
KEV CVEs whose mapped technique this analytic detects
| CVE | Vendor / product | State |
|---|---|---|
| CVE-2021-40539 | Zoho ManageEngine | Mapped |
| CVE-2021-44077 | Zoho ManageEngine ServiceDesk Plus (SDP) / SupportCenter Plus | Mapped |