T1140 — Deobfuscate/Decode Files or Information

# T1140 - Deobfuscate/Decode Files or Information

## SOC Recommendation
Investigate Deobfuscate/Decode Files or Information activity in the context of Stealth: confirm scope, affected host/identity, and whether it matches expected administrative behaviour before deciding this is benign.

## D3FEND Mappings
| D3FEND Technique | Relationship | Practical SOC Action |
|---|---|---|
| Application Exception Monitoring | Detect | Monitor for Application Exception Monitoring indicators relevant to this technique. |
| File Encryption | Harden | Apply File Encryption to reduce this technique's viability before an incident occurs. |
| File Eviction | Evict | Use File Eviction to remove the adversary's foothold once this technique is confirmed. |
| System Call Filtering | Isolate | Apply System Call Filtering to contain the blast radius once this technique is observed. |

## Investigation Steps
1. Review Defender for Endpoint / Defender XDR alerts and timeline for the affected host or identity.
2. Check Sentinel analytics rules and incidents correlated with this technique.
3. Review Entra ID sign-in and audit logs if the technique involves an identity or cloud resource.

## Evidence to Collect
- Host or resource affected
- Account or identity involved
- Timestamp of the activity
- Related process, file, or network artifact
- Any preceding or follow-on alerts

## Response Actions
| Action | Risk | Automation Safe | Approval Required |
|---|---|---|---|
| Contain the affected host or account | Medium | No | Yes |
| Collect and preserve evidence | Low | Yes | No |

## KQL
```kql
imProcessCreate
| where CommandLine contains "TVqQAAMAAAAEAAA"
| where isnotempty(Process)
| summarize StartTime = min(TimeGenerated), EndTime = max(TimeGenerated), count() by Dvc, ActorUsername, Process, CommandLine, ActingProcessName, EventVendor, EventProduct
| extend AccountName = tostring(split(ActorUsername, @'\')[1]), AccountNTDomain = tostring(split(ActorUsername, @'\')[0])
| extend HostName = tostring(split(Dvc, ".")[0]), DomainIndex = toint(indexof(Dvc, '.'))
| extend HostNameDomain = iff(DomainIndex != -1, substring(Dvc, DomainIndex + 1), Dvc)
| project-away DomainIndex
```
```kql
let threatCategory="Powershell";
let knownUserAgentsIndicators = materialize(externaldata(UserAgent:string, Category:string)
    [ @"https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/Sample%20Data/Feeds/UnusualUserAgents.csv"]
        with(format="csv", ignoreFirstRecord=True));
let knownUserAgents=toscalar(knownUserAgentsIndicators | where Category==threatCategory | where isnotempty(UserAgent) | summarize make_list(UserAgent));
let customUserAgents=toscalar(_GetWatchlist("UnusualUserAgents") | where SearchKey==threatCategory | extend UserAgent=column_ifexists("UserAgent","") | where isnotempty(UserAgent) | summarize make_list(UserAgent));
let fullUAList = array_concat(knownUserAgents,customUserAgents);
_Im_WebSession(httpuseragent_has_any=fullUAList)
| project SrcIpAddr, Url, TimeGenerated, HttpUserAgent, SrcUsername
| extend AccountName = tostring(split(SrcUsername, "@")[0]), AccountUPNSuffix = tostring(split(SrcUsername, "@")[1])
```
```kql
DynatraceSecurityProblems
| where VulnerabilityType == "CODE_LEVEL" and DAVISRiskLevel == "CRITICAL" and Muted == false
| summarize  arg_max(LastUpdatedTimeStamp, *) by SecurityProblemId
```

## Escalation Criteria
- Deobfuscate/Decode Files or Information activity observed on a privileged account or critical system.
- Activity follows or precedes other suspicious behaviour in the same investigation.
- Automated triage cannot confidently rule out malicious intent.

## False Positive Considerations
- Legitimate administrative or maintenance activity matching this pattern.
- Approved security testing or red team exercise.
- Known benign software producing similar telemetry.

Generated by SOC Response Atlas by Basyrix.

Want to push this directly to Confluence? Upgrade to Basyrix Pro.

• /api/techniques/T1140.json
• /api/recommendations/T1140.json
• /api/d3fend/T1140.json
• /api/mappings/T1140.json
• /api/confluence/T1140.md

Example curl:

curl https://atlas.basyrix.com/api/recommendations/T1140.json

Response:

{
  "technique_id": "T1140",
  "name": "Deobfuscate/Decode Files or Information",
  "priority": "high",
  "status": "draft",
  "version": "0.1.0",
  "last_reviewed": "2026-07-23",
  "generated_by": "SOC Response Atlas by Basyrix",
  "tactics": [
    "Stealth"
  ],
  "platforms": [
    "ESXi",
    "Linux",
    "macOS",
    "Windows"
  ],
  "summary": "Adversaries may use [Obfuscated Files or Information](https://attack.mitre.org/techniques/T1027) to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system...",
  "soc_recommendation": "Investigate Deobfuscate/Decode Files or Information activity in the context of Stealth: confirm scope, affected host/identity, and whether it matches expected administrative behaviour before deciding this is benign.",
  "d3fend_mappings": [
    {
      "id": "D3-AEM",
      "name": "Application Exception Monitoring",
      "relationship": "detect",
      "practical_action": "Monitor for Application Exception Monitoring indicators relevant to this technique.",
      "tooling": [
        "Defender for Endpoint"
      ]
    },
    {
      "id": "D3-FE",
      "name": "File Encryption",
      "relationship": "harden",
      "practical_action": "Apply File Encryption to reduce this technique's viability before an incident occurs.",
      "tooling": [
        "Defender for Endpoint"
      ]
    },
    {
      "id": "D3-FEV",
      "name": "File Eviction",
      "relationship": "evict",
      "practical_action": "Use File Eviction to remove the adversary's foothold once this technique is confirmed.",
      "tooling": [
        "Defender for Endpoint"
      ]
    },
    {
      "id": "D3-SCF",
      "name": "System Call Filtering",
      "relationship": "isolate",
      "practical_action": "Apply System Call Filtering to contain the blast radius once this technique is observed.",
      "tooling": [
        "Defender for Endpoint"
      ]
    }
  ],
  "investigation_steps": {
    "microsoft": [
      "Review Defender for Endpoint / Defender XDR alerts and timeline for the affected host or identity.",
      "Check Sentinel analytics rules and incidents correlated with this technique.",
      "Review Entra ID sign-in and audit logs if the technique involves an identity or cloud resource."
    ],
    "generic": [
      "Confirm whether the observed deobfuscate/decode files or information activity matches expected administrative or application behaviour.",
      "Identify the host, account, or resource where the activity occurred and its business criticality.",
      "Check for related alerts before and after this activity to reconstruct the broader intrusion timeline.",
      "Real detection reference: \"Base64 encoded Windows process command-lines (Normalized Process Events)\" -- Identifies instances of a base64 encoded PE file header seen in the process command line parameter. To use this analytics rule, make sure you have deployed the [ASIM normalization parsers](https://aka.ms/ASimProcessEvent)'"
    ]
  },
  "evidence_to_collect": [
    "Host or resource affected",
    "Account or identity involved",
    "Timestamp of the activity",
    "Related process, file, or network artifact",
    "Any preceding or follow-on alerts"
  ],
  "response_actions": [
    {
      "name": "Contain the affected host or account",
      "category": "Containment",
      "risk": "Medium",
      "automation_safe": false,
      "approval_required": true,
      "tool": "Defender for Endpoint / Entra ID",
      "notes": "Requires approval -- confirm malicious intent before isolating a host or disabling an account."
    },
    {
      "name": "Collect and preserve evidence",
      "category": "Investigation",
      "risk": "Low",
      "automation_safe": true,
      "approval_required": false,
      "tool": "Defender for Endpoint",
      "notes": "Safe -- read-only evidence collection."
    }
  ],
  "queries": {
    "kql": [
      {
        "name": "f8b3c49c-4087-499b-920f-0dcfaff0cbca — Base64 encoded Windows process command-lines (Normalized Process Events)",
        "description": "Identifies instances of a base64 encoded PE file header seen in the process command line parameter. To use this analytics rule, make sure you have deployed the [ASIM normalization parsers](https://aka.ms/ASimProcessEvent)' (Source: Microsoft's official Azure-Sentinel Detections (MIT licensed).)",
        "query": "imProcessCreate\n| where CommandLine contains \"TVqQAAMAAAAEAAA\"\n| where isnotempty(Process)\n| summarize StartTime = min(TimeGenerated), EndTime = max(TimeGenerated), count() by Dvc, ActorUsername, Process, CommandLine, ActingProcessName, EventVendor, EventProduct\n| extend AccountName = tostring(split(ActorUsername, @'\\')[1]), AccountNTDomain = tostring(split(ActorUsername, @'\\')[0])\n| extend HostName = tostring(split(Dvc, \".\")[0]), DomainIndex = toint(indexof(Dvc, '.'))\n| extend HostNameDomain = iff(DomainIndex != -1, substring(Dvc, DomainIndex + 1), Dvc)\n| project-away DomainIndex"
      },
      {
        "name": "42436753-9944-4d70-801c-daaa4d19ddd2 — A host is potentially running PowerShell to send HTTP(S) requests (ASIM Web Session schema)",
        "description": "This rule identifies a web request with a user agent header known to belong PowerShell. <br>You can add custom Powershell indicating User-Agent headers using a watchlist, for more information refer to the [UnusualUserAgents Watchlist](https://aka.ms/ASimUnusualUserAgentsWatchlist).<br><br> This analytic rule uses [ASIM](https://aka.ms/AboutASIM) and supports any built-in or custom source that supports the ASIM WebSession schema (ASIM WebSession Schema)' (Source: Microsoft's official Azure-Sentinel Detections (MIT licensed).)",
        "query": "let threatCategory=\"Powershell\";\nlet knownUserAgentsIndicators = materialize(externaldata(UserAgent:string, Category:string)\n    [ @\"https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/Sample%20Data/Feeds/UnusualUserAgents.csv\"]\n        with(format=\"csv\", ignoreFirstRecord=True));\nlet knownUserAgents=toscalar(knownUserAgentsIndicators | where Category==threatCategory | where isnotempty(UserAgent) | summarize make_list(UserAgent));\nlet customUserAgents=toscalar(_GetWatchlist(\"UnusualUserAgents\") | where SearchKey==threatCategory | extend UserAgent=column_ifexists(\"UserAgent\",\"\") | where isnotempty(UserAgent) | summarize make_list(UserAgent));\nlet fullUAList = array_concat(knownUserAgents,customUserAgents);\n_Im_WebSession(httpuseragent_has_any=fullUAList)\n| project SrcIpAddr, Url, TimeGenerated, HttpUserAgent, SrcUsername\n| extend AccountName = tostring(split(SrcUsername, \"@\")[0]), AccountUPNSuffix = tostring(split(SrcUsername, \"@\")[1])"
      },
      {
        "name": "305093b4-0fa2-57bc-bced-caea782a6e9c — Dynatrace Application Security - Code-Level runtime vulnerability detection",
        "description": "Detect Code-level runtime vulnerabilities in your environment (Source: Microsoft's official Azure-Sentinel Detections (MIT licensed).)",
        "query": "DynatraceSecurityProblems\n| where VulnerabilityType == \"CODE_LEVEL\" and DAVISRiskLevel == \"CRITICAL\" and Muted == false\n| summarize  arg_max(LastUpdatedTimeStamp, *) by SecurityProblemId"
      }
    ],
    "spl": [],
    "esql": [
      {
        "name": "74d31cb7-4a2c-44fe-9d1d-f375b9f3cb61 — Long Base64 Encoded Command via Scripting Interpreter",
        "description": "(ESQL) Identifies oversized command lines used by Python, PowerShell, Node.js, or Deno that contain base64 decoding or encoded-command patterns. Adversaries may embed long inline encoded payloads in scripting interpreters to evade inspection and execute malicious content across Windows, macOS, and Linux systems. (Source: Elastic's official detection-rules repository (Elastic License v2).)",
        "query": "FROM logs-endpoint.events.process-* METADATA _id, _index, _version, _ignored\n| MV_EXPAND _ignored\n| WHERE _ignored == \"process.command_line\"\n| WHERE event.category == \"process\" and event.type == \"start\"\n| EVAL command_line = TO_LOWER(process.command_line.text), pname = TO_LOWER(process.name)\n| WHERE \n(\n    (\n        /* Python: inline exec with base64 decode or -c flag with encoded payload */\n        pname like \"python*\" and\n        (\n            command_line like \"*b64decode*\" or\n            (command_line like \"*-c*\" and command_line like \"*base64*\")\n        )\n    ) or\n    (\n        /* PowerShell: encoded command flag — require trailing space to avoid matching\n           -Encoding, -EncryptionType, -EncryptionProvider, etc. */\n        (pname like \"powershell*\" or pname like \"pwsh*\") and\n        (\n            command_line rlike \".* -(e|en|enc|enco|encod|encode|encoded|encodedcommand) .+\" or\n            command_line like \"*-encodedcommand*\" or\n            command_line like \"*frombase64string*\"\n        )\n    ) or\n    (\n        /* Node.js: buffer.from must be paired with base64 to avoid matching\n           general Buffer usage; atob is always base64 */\n        pname like \"node*\" and\n        (\n            (command_line like \"*buffer.from*\" and command_line like \"*base64*\") or\n            command_line like \"*atob(*\"\n        )\n    ) or\n    (\n        /* Deno: eval( (not eval/evaluate/evaluation), atob, or buffer+base64 */\n        pname like \"deno*\" and\n        (\n            command_line like \"*atob(*\" or\n            (command_line like \"*buffer.from*\" and command_line like \"*base64*\") or\n            command_line like \"*eval(*\"\n        )\n    )\n)\n| EVAL Esql.length_cmdline = LENGTH(command_line)\n| WHERE Esql.length_cmdline >= 4000\n| KEEP *"
      },
      {
        "name": "d43f2b43-02a1-4219-8ce9-10929a32a618 — Potential PowerShell Obfuscation via Backtick-Escaped Variable Expansion",
        "description": "(ESQL) Detects PowerShell scripts that use backtick-escaped characters inside `${}` variable expansion (multiple backticks between word characters) to reconstruct strings at runtime. Attackers use variable-expansion obfuscation to split keywords, hide commands, and evade static analysis and AMSI. (Source: Elastic's official detection-rules repository (Elastic License v2).)",
        "query": "from logs-windows.powershell_operational* metadata _id, _version, _index\n| where event.code == \"4104\"\n\n// Filter out smaller scripts that are unlikely to implement obfuscation using the patterns we are looking for\n| eval Esql.script_block_length = length(powershell.file.script_block_text)\n| where Esql.script_block_length > 500\n\n// replace the patterns we are looking for with the 🔥 emoji to enable counting them\n// The emoji is used because it's unlikely to appear in scripts and has a consistent character length of 1\n| eval Esql.script_block_tmp = replace(powershell.file.script_block_text, \"\"\"\\$\\{(\\w++`){2,}\\w++\\}\"\"\", \"🔥\")\n\n// count how many patterns were detected by calculating the number of 🔥 characters inserted\n| eval Esql.script_block_pattern_count = length(Esql.script_block_tmp) - length(replace(Esql.script_block_tmp, \"🔥\", \"\"))\n\n// keep the fields relevant to the query, although this is not needed as the alert is populated using _id\n| keep\n    Esql.script_block_pattern_count,\n    Esql.script_block_length,\n    Esql.script_block_tmp,\n    powershell.file.*,\n    file.path,\n    file.name,\n    process.pid,\n    powershell.sequence,\n    powershell.total,\n    _id,\n    _version,\n    _index,\n    host.name,\n    host.id,\n    agent.id,\n    user.id\n\n// Filter for scripts that match the pattern at least once\n| where Esql.script_block_pattern_count >= 1"
      }
    ]
  },
  "automation": {
    "safe": [
      "Add recommendation as Sentinel incident comment.",
      "Run enrichment queries.",
      "Create ServiceNow SecOps task."
    ],
    "approval_required": [
      "Contain or disable the affected host/account.",
      "Any change to production configuration."
    ]
  },
  "escalation_criteria": [
    "Deobfuscate/Decode Files or Information activity observed on a privileged account or critical system.",
    "Activity follows or precedes other suspicious behaviour in the same investigation.",
    "Automated triage cannot confidently rule out malicious intent."
  ],
  "false_positive_considerations": [
    "Legitimate administrative or maintenance activity matching this pattern.",
    "Approved security testing or red team exercise.",
    "Known benign software producing similar telemetry."
  ],
  "confluence": {
    "title": "T1140 - Deobfuscate/Decode Files or Information Response Guidance",
    "labels": [
      "mitre",
      "attack",
      "d3fend",
      "secops",
      "basyrix"
    ],
    "sections": [
      "summary",
      "d3fend_mappings",
      "investigation_steps",
      "response_actions",
      "queries",
      "automation",
      "escalation_criteria",
      "false_positive_considerations"
    ]
  }
}