Tag
high
advisory
Command Obfuscation via Unicode Modifier Letters
2 rules 1 TTPAdversaries evade string-based detections by replacing ASCII characters with visually similar Unicode modifier letters in command lines, leading to execution of malicious commands.
Windows +1
command-obfuscation
defense-evasion
2r
1t
medium
advisory
Windows Command Obfuscation via Environment Variable Substrings
2 rules 1 TTPAttackers obfuscate commands in Windows by dynamically constructing them using substrings extracted from environment variables, a technique observed in malware families such as Cobalt Strike and Meterpreter.
Splunk Enterprise +2
command-obfuscation
defense-evasion
windows
2r
1t