The same command can be typed a hundred ways. Add a caret here, split a string there, encode the whole thing, and a signature that looks for the plain text finds nothing. The operating system still runs it exactly as intended.
MITRE tracks this as Command Obfuscation, technique T1027.010, a sub-technique of Obfuscated Files or Information in the Stealth tactic. It applies to Linux, macOS and Windows.
How attackers use it
Command line obfuscation makes strings and patterns inside commands and scripts harder to signature and analyze. It can appear in commands run by delivered payloads, for example from phishing or drive-by compromise, or interactively through a command and scripting interpreter.
MITRE lists several flavors:
- Syntax tricks. Symbols and escape characters such as spaces,
^,+,$and%placed so the command is hard to read but functionally the same. - Built-in encoding. Many languages support base64 or URL encoding.
- String manipulation. Splitting strings, changing the order and case of characters, globbing, and passing strings through tokens, environment variables or input streams.
- Path tricks. Directory traversals inserted so the reference to the binary being run is disguised, even though the path resolves to the same program.
- Obfuscation tools. MITRE names Invoke-Obfuscation and Invoke-DOSfucation as tools used to generate this.
The result is a command line that looks like noise to a human and a simple string match, but means something specific to the interpreter.
How to detect it
MITRE's strategy (DET0505) points to patterns in the command line itself:
- Windows. Excessive escape characters, base64 encoding, command concatenation, and outliers in command length and entropy.
- Linux and similar shells. Encoded execution, command chaining, excessive piping and unusual token patterns.
- macOS. Obfuscated commands run through shell, osascript or AppleScript interpreters with unusual tokens, encoding, variable substitution or runtime string reconstruction.
To make that detectable, you must first collect the command lines. Useful sources:
- Windows process creation events (4688) with command line auditing on, or Sysmon event ID 1.
- PowerShell script block logging (event ID 4104), which records script content as the engine sees it.
- AMSI, which lets security products inspect commands after the interpreter has processed them. That is the key advantage: obfuscation has to be undone before a command runs, so inspecting after interpretation sees through much of it.
- On Linux, auditd execve records.
Detection ideas that work without knowing any specific obfuscation tool:
- Command lines that are unusually long compared with the same program's normal use.
- A high ratio of special characters to letters.
- Encoded arguments passed to interpreters, especially from parents like office applications or browsers.
- Paths that contain many parent directory hops before reaching a system binary.
Expect false positives from installers and admin scripts. Tune by parent process and by host role.
How to reduce the risk
MITRE lists two mitigations.
- Behavior prevention on endpoint. On Windows 10 and later, enable Attack Surface Reduction (ASR) rules to block execution of potentially obfuscated scripts.
- Antivirus and AMSI. Use AMSI on Windows 10 and later so commands are analyzed after processing.
Make both mandatory on managed Windows devices, and verify them rather than assuming.
Check your own environment
# Windows: ASR rule configuration
Get-MpPreference | Select-Object AttackSurfaceReductionRules_Ids, AttackSurfaceReductionRules_Actions
# Windows: command line in process creation events
reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\Audit" /v ProcessCreationIncludeCmdLine_Enabled
# Windows: PowerShell script block logging policy
reg query "HKLM\SOFTWARE\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging"
# Linux: are audit rules loaded (look for execve rules)?
sudo auditctl -l
Also ask:
- Do you keep full command lines for every process, on every platform, for long enough to investigate?
- Is script block logging on for all managed endpoints?
- Do detection rules rely on plain strings, or do they also look at length, entropy and character mix?
- Are ASR rules in block mode where the business can tolerate it?
Quick check
Why is AMSI useful against command obfuscation?
Obfuscated content has to be decoded before it runs. AMSI lets security tools analyze commands after they have been processed or interpreted, so many layers of obfuscation are already gone by then.
Name two signs of an obfuscated command line from MITRE's strategy.
Excessive escape characters, base64 encoding, command concatenation, outlier command length or entropy, encoded execution, excessive piping or unusual token patterns. Any two.
Do you need to know the specific obfuscation tool to detect the technique?
No. Structural signals such as length, entropy, character mix and encoded arguments flag the behavior regardless of which tool produced it.
Sources
- MITRE ATT&CK, Command Obfuscation (T1027.010)
