Character-obfuscated command execution

cmd_obfuscated_exec

Executes a recon command hidden with caret escaping and environment-variable substitution on Windows, or quote splitting on macOS/Linux — the string-obfuscation tricks command-line telemetry is supposed to see through.

Severity medium how bad it would be if it were real

Expected outcome Something should notice

Platforms 3 macOS, Linux, Windows

Isolation subprocess runs in its own process, so a kill is a measurement

What it needs before it will run

runs in --safe
Observation only. It runs even in the inert mode, because it changes nothing and sends nothing.

Gates are cumulative and none of them is implied by another: see the three gates for why they are separate decisions.

ATT&CK techniques it exercises

MITRE ATT&CK techniques this test maps to.
Technique	Name	Tactic	Across public reports
T1027.010	Command Obfuscation	Defense Evasion	coverage statistics
T1059.003	Windows Command Shell	Execution	coverage statistics

How often anything notices

Not enough data: fewer than 3 public reports have run this test, so no rate is published for it. Groups below that threshold are withheld everywhere on the site — with one or two contributors an average is one organisation's result with a percent sign after it.

Other obfuscation and scripting tests

Other tests in the Obfuscation and scripting category.
Test	What it does	Severity
AMSI test sample execution amsi_test_string	Passes Microsoft's published AMSI test sample string to PowerShell. A working Antimalware Scan Interface provider must refuse the script, so a clean r…	medium
Download cradle pattern powershell_download_cradle	Uses the Net.WebClient download-cradle pattern (Windows) or a curl-into-shell pipeline (macOS/Linux) against a harmless connectivity endpoint. The fet…	medium
Base64-encoded PowerShell/shell execution powershell_encoded_command	Runs a base64-encoded command through powershell -EncodedCommand (Windows) or a base64 pipe into sh (macOS/Linux). The payload only prints a marker an…	medium

the whole catalogue this test in the list run it yourself

Catalogue generated from client 0.1.0. A test's behaviour can change between releases; this page describes the version named here.