Wiki › Techniques, Tactics & Procedures (TTPs) › Defense Evasion › Encoded Command Execution

Encoded Command Execution

2 min read

Jump to:

Overview

Encoded Command Execution is a technique used by adversaries to run commands or scripts in an encoded format to evade detection and bypass security controls. This technique is commonly employed during the Execution phase of an attack but can also support other stages by enabling stealthy command invocation. Encoding commands helps attackers obscure their activities from monitoring tools and security mechanisms.

Attack Objective

Execute arbitrary commands or code while avoiding detection
Supports Execution primarily, with potential use in Persistence, Privilege Escalation, and Defense Evasion
Advances attacker control by enabling covert command execution and reducing visibility

How the Technique Works

Adversaries encode commands using various encoding schemes such as Base64 or hexadecimal before execution. The encoded payload is then decoded and executed by a legitimate interpreter or shell, often leveraging built-in system utilities. This obfuscation conceals the command’s intent and content from simple inspection or signature-based defenses.

Common Methods & Variations

Encoding commands in Base64 for PowerShell, Windows Command Prompt, or Unix shells
Use in on-premises endpoints, cloud environments, and identity systems where script execution is possible
Living-off-the-land techniques leveraging native interpreters versus custom encoded payloads

Indicators of Compromise (IOCs)

Presence of encoded command strings in process command-line arguments or script files
Unusual invocation of scripting engines with encoded parameters
Logs showing decoding or execution of encoded payloads in endpoint or cloud telemetry

Detection Strategies

Monitoring command-line arguments and script execution logs for encoded content patterns
Behavioral detection focusing on anomalous use of scripting interpreters and decoding routines
Correlation of encoded command execution with other suspicious activities or privilege escalations

Mitigation & Prevention

Restrict or monitor use of scripting engines and command interpreters
Implement application control policies to limit execution of encoded or obfuscated commands
Enforce least privilege and multi-factor authentication to reduce unauthorized execution

Response Considerations

Immediately isolate affected systems to prevent further encoded command execution
Analyze logs and memory to identify decoded commands and related attacker actions
Harden endpoint and cloud configurations to prevent recurrence and improve detection

Related Techniques

Command and Scripting Interpreter use
Obfuscated Files or Information
Living-off-the-Land Binaries and Scripts

Mapping & References

MITRE ATT&CK: T1059 (Command and Scripting Interpreter), T1140 (Deobfuscate/Decode Files or Information)
Public advisories and research on encoded PowerShell and shell command abuse

Tags: Command and Control Cyberattack Techniques Defense Evasion Encoded Commands Execution Initial Access Obfuscation persistence privilege escalation TTPs