Analytics BIOC
Informational
✕
Possible data obfuscation
A command that can be used for file obfuscation was executed with an uncommon command line.
- Module:
- Platform Analytics
- Data source:
- XDR Agent
ATT&CK tactics: Defense Evasion (TA0005)
ATT&CK techniques: Deobfuscate/Decode Files or Information (T1140)
Detector tags: Kubernetes - AGENT Containers
Attacker's goals:
Attackers may use obfuscated files to cover their tracks.
Investigative actions:
Check whether the executing process is benign and if this was a desired behavior as part of its normal execution flow.
- Test period:
- N/A (single event)
- Deduplication:
- 1 Day
1 variation:
- Possible data obfuscation in a Kubernetes pod Low (parent: Informational)