MITRE ATT&CK technique · stealth

`T1027.009` Embedded Payloads

Sub-technique of T1027 Obfuscated Files or Information

Adversaries may embed payloads within other files to conceal malicious content from defenses. Otherwise seemingly benign files (such as scripts and executables) may be abused to carry and obfuscate malicious payloads and content. In some cases, embedded payloads may also enable adversaries to [Subvert Trust Controls](https://attack.mitre.org/techniques/T1553) by not impacting execution controls…

MITRE ATT&CK page ↗

Who uses it · with stories on Jábega

Lazarus Group

Sigma rules to hunt it

Powershell Token Obfuscation - Process Creationhightest · windows

Rules from SigmaHQ · Detection Rule License 1.1. Technique from MITRE ATT&CK®.