Detecting and Mitigating Encrypted or Encoded Files (T1027.013)

Encryption keeps secrets from being read. That is as useful to an intruder as it is to you. If a malicious file is encrypted or encoded on disk, a scanner sees noise, and the real content shows up only when something decodes it at run time.

MITRE tracks this as Encrypted/Encoded File, technique T1027.013, a sub-technique of Obfuscated Files or Information in the Stealth tactic. It applies to Linux, macOS and Windows.

How attackers use it

The aim is to hide strings, bytes and other patterns that would give a file away. MITRE says many techniques share that objective, including software packing, steganography and embedded payloads, and the hidden content is revealed at the time of execution or use.

Key points from MITRE's description:

• It applies to many files on a victim host, such as malware logs, configuration and payload files.
• Files can be encrypted with a hardcoded key or a user-supplied key, or encoded with standard schemes such as Base64.
• The entire file may be obfuscated, or just specific values such as command and control addresses.
• Encryption and encoding may be stacked in redundant layers.
• Password protected Word documents and self-extracting (SFX) archives are examples. An SFX file attaches archived content to a decompressor stub that runs when the file is opened, which often relies on user execution.
• File specific and custom encoding schemes can also be abused. MITRE mentions Byte Order Mark (BOM) headers in text files as one example.

The result is a file that is inert to a static scan and fully active once opened.

How to detect it

MITRE's strategy (DET0087) is about decoding behavior:

• Processes that load or decode encrypted or encoded files in memory and then execute or inject them, which indicates unpacking or memory resident malware.
• Shell utilities or scripts that decode or decrypt a payload and run it without writing it to disk.
• Encoded payloads decoded and executed in memory by scripting tools or third party decoders.

Steps to make that visible:

1. Capture command lines. Process creation events with command line (Windows event 4688 or Sysmon event ID 1) show decode utilities and their arguments.
2. Log script content. PowerShell script block logging (event ID 4104) records scripts after decoding in many cases.
3. Look at entropy. High entropy content in a place that normally holds text, such as a config file, log or document, can point to encrypted data. MITRE mentions high entropy as a sign for antivirus tools.
4. Watch the parent. A document or archive handler that starts a decoder, an interpreter or a child process is the pattern to flag.
5. Treat password protected attachments as higher risk. Security tools cannot open them, and attackers know that.

Expect noise from legitimate compression, backup and software installers. Filter by parent process, user role and path.

How to reduce the risk

MITRE lists two mitigations.

1. Antivirus and antimalware. Detect and quarantine suspicious files, including those with high entropy measurements or other signs of obfuscation.
2. Behavior prevention on endpoint. On Windows 10 and later, enable Attack Surface Reduction (ASR) rules to block execution of potentially obfuscated scripts. MITRE adds that security tools should be configured to analyze the encoding properties of files and detect anomalies that deviate from standard encoding practice.

Add a policy angle: decide what to do with attachments you cannot inspect. Many organizations quarantine or hold password protected archives from outside for review.

Check your own environment

# Windows: ASR rules configured, and their action (0 off, 1 block, 2 audit)
Get-MpPreference | Select-Object AttackSurfaceReductionRules_Ids, AttackSurfaceReductionRules_Actions

# Windows: is command line capture enabled for process creation events?
reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\Audit" /v ProcessCreationIncludeCmdLine_Enabled

# Linux: are audit rules loaded?
sudo auditctl -l

Checklist:

• What does your mail gateway do with password protected archives and documents?
• Can your endpoint tools look inside self-extracting archives?
• Is script block logging on, so decoded script content is recorded?
• Do you have alerts for decode utilities started by office applications or archive tools?
• Are ASR rules in block mode on managed Windows devices?

Quick check

Sources

• MITRE ATT&CK, Encrypted/Encoded File (T1027.013)