Adversaries may obfuscate content during command execution to impede detection. Command-line obfuscation is a method of making strings and patterns within commands and scripts more difficult to signature and analyze. This type of obfuscation can be included within commands executed by delivered payloads (e.g., [Phishing](https://attack.mitre.org/techniques/T1566) and [Drive-by Compromise](https://attack.mitre.org/techniques/T1189)) or interactively via [Command and Scripting Interpreter](https://attack.mitre.org/techniques/T1059).(Citation: Akamai JS)(Citation: Malware Monday VBE)

For example, adversaries may abuse syntax that utilizes various symbols and escape characters (such as spacing,  `^`, `+`. `$`, and `%`) to make commands difficult to analyze while maintaining the same intended functionality.(Citation: RC PowerShell) Many languages support built-in obfuscation in the form of base64 or URL encoding.(Citation: Microsoft PowerShellB64) Adversaries may also manually implement command obfuscation via string splitting (`“Wor”+“d.Application”`), order and casing of characters (`rev <<<'dwssap/cte/ tac'`), globing (`mkdir -p '/tmp/:&$NiA'`), as well as various tricks involving passing strings through tokens/environment variables/input streams.(Citation: Bashfuscator Command Obfuscators)(Citation: FireEye Obfuscation June 2017)

Adversaries may also use tricks such as directory traversals to obfuscate references to the binary being invoked by a command (`C:\voi\pcw\..\..\Windows\tei\qs\k\..\..\..\system32\erool\..\wbem\wg\je\..\..\wmic.exe shadowcopy delete`).(Citation: Twitter Richard WMIC)

Tools such as <code>Invoke-Obfuscation</code> and <code>Invoke-DOSfucation</code> have also been used to obfuscate commands.(Citation: Invoke-DOSfuscation)(Citation: Invoke-Obfuscation)
Command Obfuscation
source_name: mitre-attack  url: https://attack.mitre.org/techniques/T1027/010  external_id: T1027.010     source_name: Twitter Richard WMIC  description: Ackroyd, R. (2023, March 24). Twitter. Retrieved March 24, 2023.  url: https://twitter.com/rfackroyd/status/1639136000755765254     source_name: Invoke-Obfuscation  description: Bohannon, D. (2016, September 24). Invoke-Obfuscation. Retrieved March 17, 2023.  url: https://github.com/danielbohannon/Invoke-Obfuscation     source_name: Invoke-DOSfuscation  description: Bohannon, D. (2018, March 19). Invoke-DOSfuscation. Retrieved March 17, 2023.  url: https://github.com/danielbohannon/Invoke-DOSfuscation     source_name: FireEye Obfuscation June 2017  description: Bohannon, D. & Carr N. (2017, June 30). Obfuscation in the Wild: Targeted Attackers Lead the Way in Evasion Techniques. Retrieved February 12, 2018.  url: https://web.archive.org/web/20170923102302/https://www.fireeye.com/blog/threat-research/2017/06/obfuscation-in-the-wild.html     source_name: Malware Monday VBE  description: Bromiley, M. (2016, December 27). Malware Monday: VBScript and VBE Files. Retrieved March 17, 2023.  url: https://bromiley.medium.com/malware-monday-vbscript-and-vbe-files-292252c1a16     source_name: Akamai JS  description: Katz, O. (2020, October 26). Catch Me if You Can—JavaScript Obfuscation. Retrieved March 17, 2023.  url: https://www.akamai.com/blog/security/catch-me-if-you-can-javascript-obfuscation     source_name: Bashfuscator Command Obfuscators  description: LeFevre, A. (n.d.). Bashfuscator Command Obfuscators. Retrieved March 17, 2023.  url: https://bashfuscator.readthedocs.io/en/latest/Mutators/command_obfuscators/index.html     source_name: Microsoft PowerShellB64  description: Microsoft. (2023, February 8). about_PowerShell_exe: EncodedCommand. Retrieved March 17, 2023.  url: https://learn.microsoft.com/powershell/module/microsoft.powershell.core/about/about_powershell_exe?view=powershell-5.1#-encodedcommand-base64encodedcommand     source_name: RC PowerShell  description: Red Canary. (n.d.). 2022 Threat Detection Report: PowerShell. Retrieved March 17, 2023.  url: https://redcanary.com/threat-detection-report/techniques/powershell/     