Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
One such example is the use of certutil to decode a remote access tool portable executable file that has been hidden inside a certificate file.(Citation: Malwarebytes Targeted Attack against Saudi Arabia) Another example is using the Windows <code>copy /b</code> command to reassemble binary fragments into a malicious payload.(Citation: Carbon Black Obfuscation Sept 2016)
Sometimes a user's action may be required to open it for deobfuscation or decryption as part of User Execution. The user may also be required to input a password to open a password protected compressed/encrypted file that was provided by the adversary. (Citation: Volexity PowerDuke November 2016)
View in MITRE ATT&CK®| Capability ID | Capability Description | Mapping Type | ATT&CK ID | ATT&CK Name | Notes |
|---|---|---|---|---|---|
| intel-tdt | Intel Threat Detection Technology | CrowdStrike AMS | T1140 | Deobfuscate/Decode Files or Information |
Comments
Intel Threat Detection Technology's (Intel TDT) Accelerated Memory Scanning (AMS) enables efficient memory scanning by offloading these operations to the integrated Graphics Processor Unit (integrated GPU) on Intel client SoCs.
Microsoft Defender Antivirus leverages AMS to optimize the detection of polymorphic and fileless attacks, improving resource efficiency and reducing the performance impact on the Central Processing Unit (CPU).
Intel Threat Detection Technology (TDT), combined with CrowdStrike's Accelerated Memory Scanning (CAMS), enhances cybersecurity defenses by enabling faster, real-time protection of de-obfuscation and file decoding attacks. This integrated solution strengthens CrowdStrike Falcon, improving its ability to detect and mitigate cyber threats earlier in the kill chain, all while minimizing system performance impact.
De-obfuscation and file decoding attacks involve adversaries using techniques to reverse obfuscation or decoding algorithms to reveal and execute malicious code that was previously disguised or hidden. These attacks are commonly used in malware campaigns, where payloads are obfuscated or encoded to evade detection by traditional security tools. Intel TDT plays a critical role in identifying these threats by providing real-time telemetry on program execution, memory access, and control flow, enabling rapid detection of abnormal behaviors, such as the de-obfuscation of malicious code or decoding of hidden payloads.
Additionally, CAMS offloads the performance-intensive memory scanning workload from the CPU to the Intel Integrated GPU, ensuring faster and more efficient detection of malicious activity without impacting system performance. CAMS helps identify suspicious behaviors, such as the presence of code attempting to decode or de-obfuscate payloads, enabling organizations to proactively detect and mitigate these evasive techniques.
References
|
| intel-tdt | Intel Threat Detection Technology | Microsoft Defender | T1140 | Deobfuscate/Decode Files or Information |
Comments
Intel Threat Detection Technology's (Intel TDT) Accelerated Memory Scanning (AMS) enables efficient memory scanning by offloading these operations to the integrated Graphics Processor Unit (integrated GPU) on Intel client SoCs.
Microsoft Defender Antivirus leverages AMS to optimize the detection of polymorphic and fileless attacks, improving resource efficiency and reducing the performance impact on the Central Processing Unit (CPU).
Intel Threat Detection Technology (TDT), combined with CrowdStrike's Accelerated Memory Scanning (CAMS), enhances cybersecurity defenses by enabling faster, real-time protection of de-obfuscation and file decoding attacks. This integrated solution strengthens CrowdStrike Falcon, improving its ability to detect and mitigate cyber threats earlier in the kill chain, all while minimizing system performance impact.
De-obfuscation and file decoding attacks involve adversaries using techniques to reverse obfuscation or decoding algorithms to reveal and execute malicious code that was previously disguised or hidden. These attacks are commonly used in malware campaigns, where payloads are obfuscated or encoded to evade detection by traditional security tools. Intel TDT plays a critical role in identifying these threats by providing real-time telemetry on program execution, memory access, and control flow, enabling rapid detection of abnormal behaviors, such as the de-obfuscation of malicious code or decoding of hidden payloads.
Additionally, CAMS offloads the performance-intensive memory scanning workload from the CPU to the Intel Integrated GPU, ensuring faster and more efficient detection of malicious activity without impacting system performance. CAMS helps identify suspicious behaviors, such as the presence of code attempting to decode or de-obfuscate payloads, enabling organizations to proactively detect and mitigate these evasive techniques.
References
|
| intel-tdt | Intel Threat Detection Technology | CrowdStrike AMS | T1140 | Deobfuscate/Decode Files or Information |
Comments
Intel Threat Detection Technology's (Intel TDT) Accelerated Memory Scanning (AMS) enables efficient memory scanning by offloading these operations to the integrated Graphics Processor Unit (integrated GPU) on Intel client SoCs.
Microsoft Defender Antivirus leverages AMS to optimize the detection of polymorphic and fileless attacks, improving resource efficiency and reducing the performance impact on the Central Processing Unit (CPU).
Intel Threat Detection Technology (TDT), combined with CrowdStrike's Accelerated Memory Scanning (CAMS), enhances cybersecurity defenses by enabling faster, real-time detection of deobfuscation and file decoding attacks. This integrated solution strengthens CrowdStrike Falcon, improving its ability to detect and mitigate cyber threats earlier in the kill chain, all while minimizing system performance impact.
De-obfuscation and file decoding attacks involve adversaries using techniques to reverse obfuscation or decoding algorithms to reveal and execute malicious code that was previously disguised or hidden. These attacks are commonly used in malware campaigns, where payloads are obfuscated or encoded to evade detection by traditional security tools. Intel TDT plays a critical role in identifying these threats by providing real-time telemetry on program execution, memory access, and control flow, enabling rapid detection of abnormal behaviors, such as the de-obfuscation of malicious code or decoding of hidden payloads.
Additionally, CAMS offloads the performance-intensive memory scanning workload from the CPU to the Intel Integrated GPU, ensuring faster and more efficient detection of malicious activity without impacting system performance. CAMS helps identify suspicious behaviors, such as the presence of code attempting to decode or de-obfuscate payloads, enabling organizations to proactively detect and mitigate these evasive techniques.
References
|
| intel-tdt | Intel Threat Detection Technology | Microsoft Defender | T1140 | Deobfuscate/Decode Files or Information |
Comments
Intel Threat Detection Technology's (Intel TDT) Accelerated Memory Scanning (AMS) enables efficient memory scanning by offloading these operations to the integrated Graphics Processor Unit (integrated GPU) on Intel client SoCs.
Microsoft Defender Antivirus leverages AMS to optimize the detection of polymorphic and fileless attacks, improving resource efficiency and reducing the performance impact on the Central Processing Unit (CPU).
Intel Threat Detection Technology (TDT), combined with CrowdStrike's Accelerated Memory Scanning (CAMS), enhances cybersecurity defenses by enabling faster, real-time detection of deobfuscation and file decoding attacks. This integrated solution strengthens CrowdStrike Falcon, improving its ability to detect and mitigate cyber threats earlier in the kill chain, all while minimizing system performance impact.
De-obfuscation and file decoding attacks involve adversaries using techniques to reverse obfuscation or decoding algorithms to reveal and execute malicious code that was previously disguised or hidden. These attacks are commonly used in malware campaigns, where payloads are obfuscated or encoded to evade detection by traditional security tools. Intel TDT plays a critical role in identifying these threats by providing real-time telemetry on program execution, memory access, and control flow, enabling rapid detection of abnormal behaviors, such as the de-obfuscation of malicious code or decoding of hidden payloads.
Additionally, CAMS offloads the performance-intensive memory scanning workload from the CPU to the Intel Integrated GPU, ensuring faster and more efficient detection of malicious activity without impacting system performance. CAMS helps identify suspicious behaviors, such as the presence of code attempting to decode or de-obfuscate payloads, enabling organizations to proactively detect and mitigate these evasive techniques.
References
|