Obfuscation
noun · also Obfuscated code · MITRE ATT&CK T1027
Deliberately making code, commands or data hard to read, through encoding, compression or scrambling, so defenders and security tools miss what it does.
Attackers rarely leave their commands in plain text. They encode them in Base64, compress them, split strings into pieces, insert random capitalization, or wrap one script inside another. The goal is to slip past signature-based detection, which looks for known strings, and to slow down the analyst who has to work out what the code does. MITRE ATT&CK tracks the behavior as Obfuscated Files or Information (T1027).
Obfuscation is not encryption: the code still has to run, so everything needed to reverse it is present somewhere in the sample. Analysts reverse it layer by layer with tools such as CyberChef, while defenses such as AMSI inspect scripts after the script engine has removed the layers.
Example
A command line contains powershell -enc followed by a long string of letters. Decoding the Base64 reveals a second script that decompresses a gzip blob, which in turn contains a third script that downloads malware. Three layers of obfuscation hide a single download command.
Why it matters for a SOC analyst
Heavily encoded or scrambled commands are suspicious in themselves, because legitimate administration rarely needs them. Learning to peel off common layers quickly lets you tell a real threat from a false alarm and extract the indicators of compromise hidden inside.
Related terms
- Malware
Any software designed to harm a system or its users, such as viruses, worms, trojans, ransomware, spyware and infostealers.
- Fileless malware
Malicious code that runs in memory or through legitimate tools like PowerShell, leaving few or no malicious files on disk to scan.
- AMSI
A Windows interface that lets applications such as PowerShell send scripts to the installed antivirus for scanning just before they run.
- Living off the land
Attacking with tools already present on the victim's systems, such as PowerShell or WMI, so the activity blends in with normal administration.
- Indicator of compromise
An observable artifact, such as a file hash, IP address, domain or registry key, that suggests a system may have been compromised.