Attackers hide or disguise malware, commands, or data so that security tools and analysts cannot easily detect or understand it. T1027 techniques modify files, scripts, binaries, or execution logic to evade static analysis, signature-based detection, and behavioral monitoring by introducing obfuscation, encryption, encoding, compression, or runtime resolution.
Sub-Techniques Explained (Easy + Technical)
T1027.001 – Binary Padding
Easy: Add useless data to make malware look different.
Technical: Appends non-functional bytes to change file hash.
IOCs:
- Unusual file size increases
- Same behavior, different hashes
T1027.002 – Software Packing
Easy: Compress or encrypt malware to hide it.
Technical: Uses packers (UPX, Themida) that unpack code at runtime.
IOCs:
- High entropy sections
- Suspicious unpacking routines
T1027.003 – Steganography
Easy: Hide malware or data inside images/audio.
Technical: Payload embedded in image pixels or metadata.
IOCs:
- Large image files with no visual difference
- Network traffic downloading images used as executables
T1027.004 – Compile After Delivery
Easy: Malware is built on the victim’s system.
Technical: Source code delivered and compiled locally using compilers.
IOCs:
gcc,cl.exe,csc.exeexecution- Temporary source files
T1027.005 – Indicator Removal from Tools
Easy: Remove hacker names, IPs, or strings.
Technical: Modifies malware to strip debug strings and signatures.
IOCs:
- Missing expected metadata
- Generic or blank version info
T1027.006 – HTML Smuggling
Easy: Malware hidden in web pages.
Technical: JavaScript reconstructs payload in browser memory.
IOCs:
- HTML files creating blobs
- Downloads without direct URLs
T1027.007 – Dynamic API Resolution
Easy: Malware hides Windows API names.
Technical: Resolves APIs at runtime using hashes or custom loaders.
IOCs:
- No API imports in PE file
- Calls to
GetProcAddress,LoadLibrary
T1027.008 – Stripped Payloads
Easy: Remove extra information from malware.
Technical: Removes symbols, debug info, and headers.
IOCs:
- Minimal PE headers
- Missing symbol tables
T1027.009 – Embedded Payloads
Easy: Hide malware inside another file.
Technical: Payload embedded in executables, documents, or scripts.
IOCs:
- Large resources in PE files
- Macros extracting binaries
T1027.010 – Command Obfuscation
Easy: Make commands hard to read.
Technical: Uses encoding, concatenation, or variable substitution.
IOCs:
- Base64 PowerShell commands
- Excessive string concatenation
T1027.011 – Fileless Storage
Easy: Malware lives in memory, not files.
Technical: Uses registry, WMI, or memory-only execution.
IOCs:
- Registry keys with encoded data
- Suspicious PowerShell memory execution
T1027.012 – LNK Icon Smuggling
Easy: Shortcut looks safe but runs malware.
Technical: LNK icon points to decoy while executing hidden command.
IOCs:
- LNK files executing
cmd.exeorpowershell.exe - Icon mismatch
T1027.013 – Encrypted / Encoded File
Easy: Malware is locked with encryption.
Technical: AES, XOR, Base64 used to hide payload.
IOCs:
- High entropy files
- Decryption routines in memory
T1027.014 – Polymorphic Code
Easy: Malware changes itself every time.
Technical: Code mutates while keeping same functionality.
IOCs:
- Constant hash changes
- Similar behavior across different samples
T1027.015 – Compression
Easy: Squeeze malware to hide content.
Technical: ZIP, GZIP, custom compression layers.
IOCs:
- Nested compressed files
- Self-decompression logic
T1027.016 – Junk Code Insertion
Easy: Add useless code to confuse analysis.
Technical: Inserts dead loops, fake logic paths.
IOCs:
- Large blocks of unused instructions
- No-op operations
T1027.017 – SVG Smuggling
Easy: Malware hidden inside SVG images.
Technical: SVG contains JavaScript that drops payload.
IOCs:
- SVG files with embedded scripts
- Browser-based file creation
Summary Table
| ID | Name | Purpose | Common IOCs |
|---|---|---|---|
| T1027.001 | Binary Padding | Hash evasion | Size anomalies |
| T1027.002 | Software Packing | Hide payload | High entropy |
| T1027.003 | Steganography | Hide in media | Image misuse |
| T1027.004 | Compile After Delivery | Avoid signatures | Local compilers |
| T1027.005 | Indicator Removal | Evade detection | Missing metadata |
| T1027.006 | HTML Smuggling | Browser delivery | JS blob creation |
| T1027.007 | Dynamic API Resolution | Hide imports | Runtime API calls |
| T1027.008 | Stripped Payloads | Minimal footprint | Missing symbols |
| T1027.009 | Embedded Payloads | Hide malware | Resource extraction |
| T1027.010 | Command Obfuscation | Hide commands | Encoded strings |
| T1027.011 | Fileless Storage | Disk evasion | Registry payloads |
| T1027.012 | LNK Icon Smuggling | User deception | Malicious LNK |
| T1027.013 | Encrypted Files | Hide content | Decryption loops |
| T1027.014 | Polymorphic Code | Avoid signatures | Changing hashes |
| T1027.015 | Compression | Obfuscation | Nested archives |
| T1027.016 | Junk Code | Analysis evasion | Dead code |
| T1027.017 | SVG Smuggling | Web-based delivery | Scripted SVGs |
Real-World Malware Examples (T1027)
Malware: Emotet
How it used obfuscation
- Packed with custom packers
- Unpacks itself only in memory
- Changes hash every campaign
Why
- Evades antivirus signatures
IOCs
- High entropy sections
- Memory unpacking behavior
- Suspicious
VirtualAlloc + WriteProcessMemory
2️⃣ Steganography (T1027.003)
Malware: Hammertoss (APT29)
How
- C2 commands hidden inside Twitter images
- Malware extracts data from pixels
Why
- Blends into normal social media traffic
IOCs
- Images downloaded but never displayed
- Pixel-level data extraction
3️⃣ HTML Smuggling (T1027.006)
Malware: QakBot
How
- Malicious HTML email attachment
- JavaScript builds ZIP/ISO file locally
Why
- Bypasses email gateways
IOCs
.htmlattachments creating.zipor.iso- JavaScript
Blob()usage
4️⃣ Command Obfuscation (T1027.010)
Malware: PowerShell Empire
How
- Base64 encoded PowerShell
- String concatenation and environment variables
Why
- Avoids command-line detection
IOCs
powershell.exe -enc- Long Base64 strings
5️⃣ Fileless Storage (T1027.011)
Malware: Poweliks
How
- No executable file on disk
- Payload stored in Windows Registry
Why
- Disk-based AV can’t see it
IOCs
- Suspicious registry keys with encoded data
powershell.exespawned fromdllhost.exe
6️⃣ Dynamic API Resolution (T1027.007)
Malware: TrickBot
How
- API names stored as hashes
- Resolved at runtime
Why
- Hides malicious imports from static scanners
IOCs
- Few or no imports in PE
- Heavy use of
GetProcAddress
7️⃣ SVG Smuggling (T1027.017)
Malware: BazarLoader
How
- SVG email attachment
- Embedded JavaScript drops malware
Why
- SVG seen as image, not executable
IOCs
- SVG with
<script>tags - Browser creating executable files
8️⃣ Polymorphic Code (T1027.014)
Malware: VirLock
How
- Rewrites its own code on every infection
- Encrypts itself differently each time
Why
- Signature evasion
IOCs
- Constantly changing hashes
- Same runtime behavior
