Some files are containers more than programs. A normal looking script or executable can carry another payload inside it, and the outer file may keep passing every trust check you have.
MITRE tracks this as Embedded Payloads, technique T1027.009, a sub-technique of Obfuscated Files or Information in the Stealth tactic. It applies to Linux, macOS and Windows.
How attackers use it
Adversaries embed payloads in other files to hide malicious content. Seemingly benign scripts and executables can carry them. MITRE notes this can also help the adversary subvert trust controls, because execution controls such as digital signatures and notarization tickets may not be affected by the embedded content.
It is similar to steganography but does not weave data into the specific bytes of a media format. MITRE lists several forms:
- Payloads inside or appended as an overlay to an otherwise benign binary.
- Payloads nested inside a file of the same format, such as executables and run-only scripts.
- Embedded content used as a process injection payload, for example a module injected into default browsers so the adversary can communicate over the network.
How to detect it
MITRE's strategy (DET0214) gives an analytic per platform family.
- Windows. Executables or scripts that contain hidden resources or secondary payloads, often with a mismatch between file size and apparent function, or with child binaries dropped during execution.
- Linux. Shell scripts, ELF binaries or archives with embedded secondary payloads, self-extracting components or unusual compression behavior at runtime.
- macOS. Mach-O binaries or AppleScripts with nested, encoded or run-only embedded payloads dropped at runtime.
The recurring clue is a file that does something its size and purpose do not explain, especially when it writes and launches new files as it runs.
How to reduce the risk
MITRE lists two mitigations.
- Antivirus and antimalware. Detect and quarantine suspicious files.
- Behavior prevention on endpoint. On Windows 10, enable Attack Surface Reduction (ASR) rules to prevent execution of potentially obfuscated scripts.
A signature on the outer file says who built it. It does not say what it carries. Pair signature checks with behavior monitoring.
Check your own environment
# Windows: current ASR rule IDs and their actions (0 off, 1 block, 2 audit)
Get-MpPreference | Select-Object AttackSurfaceReductionRules_Ids, AttackSurfaceReductionRules_Actions
Ask also:
- When a signed file runs and drops new executables, does your tooling notice?
- Do you review what your dependencies and installers write to disk as they run?
- Can you inspect software you bring in, such as packages, before it reaches a build or a laptop? The free in-browser dependency scan needs no login, the file never leaves your machine and it covers up to 100 dependencies.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Why can an embedded payload survive trust checks on the outer file?
The signature or notarization covers the outer file as it was built. MITRE notes embedded content may not affect those execution controls, so the carrier still looks trusted.
Sources
- MITRE ATT&CK, Embedded Payloads (T1027.009)
