Detect encoding or encryption of files under sensitive paths

Siemphony@siemphonylowT1027unverified

MITRE's Linux analytic describes base64, openssl and similar tools being used to encode or encrypt files after staging or enumeration, so this rule pairs the tool invocation with the file it was pointed at, both read off the same CommandLine field of one execve event. The tool terms and the path list are MITRE's CommandRegex and SensitivePathList knobs, populated here with openssl enc, symmetric gpg, base64 and xxd against /etc, /home, /root, /srv and /var/www; gzip and tar are deliberately absent because on any real host they would supply nearly every match. The decode and decrypt directions are filtered out, since that is the reverse behaviour and belongs to T1140. Three limits: a shell pipeline such as tar czf - /home | openssl enc leaves no path in openssl's own argv and is missed entirely, encoding of data held in a variable or a heredoc never touches a path either, and auditd emits nothing here until an execve syscall rule is loaded — the stock auditd install ships none, so this rule returns zero rows on an unconfigured host and zero rows means blind, not clean. UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0378, not hand-written and not tested by its author. Any lab result is on this rule's own page.Full description

The 4 SIEM queries below are previews produced by Siemphony’s own translator, not pySigma, and none has been executed against a real backend — review before you deploy.

detection.yml

Sentinel · KQL

Run this as a search.

DeviceProcessEvents| where (((ProcessCommandLine contains "openssl enc" or ProcessCommandLine contains "gpg --symmetric" or ProcessCommandLine contains "gpg -c " or ProcessCommandLine contains "base64 " or ProcessCommandLine contains "xxd -p") and (ProcessCommandLine contains "/etc/" or ProcessCommandLine contains "/home/" or ProcessCommandLine contains "/root/" or ProcessCommandLine contains "/srv/" or ProcessCommandLine contains "/var/www/")) and not ((ProcessCommandLine contains " -d " or ProcessCommandLine contains "--decode" or ProcessCommandLine contains "--decrypt")))

Splunk · SPL

Run this as a search.

index=* (((CommandLine="*openssl enc*" OR CommandLine="*gpg --symmetric*" OR CommandLine="*gpg -c *" OR CommandLine="*base64 *" OR CommandLine="*xxd -p*") AND (CommandLine="*/etc/*" OR CommandLine="*/home/*" OR CommandLine="*/root/*" OR CommandLine="*/srv/*" OR CommandLine="*/var/www/*")) AND NOT ((CommandLine="* -d *" OR CommandLine="*--decode*" OR CommandLine="*--decrypt*")))

Elastic · ES|QL

Run this as a search.

FROM logs-*| WHERE (((TO_LOWER(process.command_line) LIKE "*openssl enc*" OR TO_LOWER(process.command_line) LIKE "*gpg --symmetric*" OR TO_LOWER(process.command_line) LIKE "*gpg -c *" OR TO_LOWER(process.command_line) LIKE "*base64 *" OR TO_LOWER(process.command_line) LIKE "*xxd -p*") AND (TO_LOWER(process.command_line) LIKE "*/etc/*" OR TO_LOWER(process.command_line) LIKE "*/home/*" OR TO_LOWER(process.command_line) LIKE "*/root/*" OR TO_LOWER(process.command_line) LIKE "*/srv/*" OR TO_LOWER(process.command_line) LIKE "*/var/www/*")) AND NOT ((TO_LOWER(process.command_line) LIKE "* -d *" OR TO_LOWER(process.command_line) LIKE "*--decode*" OR TO_LOWER(process.command_line) LIKE "*--decrypt*")))

Wazuh · XML rule

Deploy to your manager — this is a rule, not a search.

<group name="sigma,linux,process_creation,">  <!-- Rule ids must be unique on your manager; 100000+ is the user range. -->  <rule id="100000" level="5">    <!-- Set <if_sid> to the decoder/base rule for linux so this only evaluates relevant events. -->    <field name="CommandLine" type="pcre2">(?i)(openssl enc|gpg --symmetric|gpg -c |base64 |xxd -p)</field>    <field name="CommandLine" type="pcre2">(?i)(/etc/|/home/|/root/|/srv/|/var/www/)</field>    <field name="CommandLine" negate="yes" type="pcre2">(?i)( -d |--decode|--decrypt)</field>    <description>Detect encoding or encryption of files under sensitive paths</description>    <mitre>      <id>T1027</id>    </mitre>  </rule></group>

At a glance

Logsource: process_creation / linux
Level: low
Category: obfuscated_payloads
Sigma status: experimental
Backends: 4 of 4 rendered
Updated: 30 Aug 2026
Rule ID: d1ed6f77-f8b4-4ac3-b6e2-f1e8e72bdcef

ATT&CKT1027

T1027Obfuscated Files or Information

ATT&CK® is a registered trademark of The MITRE Corporation. These mappings are the rule author’s, and are neither reviewed nor endorsed by MITRE.

Lessonobfuscated payloads

obfuscated payloadsAI draft — unreviewed

01 · What this rule detects

The rule is Detect encoding or encryption of files under sensitive paths, and it implements MITRE's Linux analytic AN1065 only — the Windows and macOS analytics under DET0378 are untouched. AN1065 describes gzip, base64, tar or openssl encoding or encrypting files after staging or enumeration. The rule pairs the tool with the file it was pointed at, both read off the same CommandLine string of one execve event, so it is looking for a single self-contained command such as base64 /etc/shadow > /tmp/s.txt, not for a pattern spread across processes.

02 · Telemetry you need

category: process_creation, product: linux, copied verbatim from the brief. On Linux that category is normally fed from auditd, and this is the prerequisite that matters: auditd emits nothing here until an execve syscall rule is loaded, and the stock install ships none. Deployed against an unconfigured host the rule returns zero rows, and zero rows reads as "quiet" when it means "blind". Confirm you are receiving execve events with populated command lines before you trust a silent result.

03 · How the logic works

Three blocks, condition selection_tool and selection_target and not filter_reverse. selection_tool is a CommandLine|contains list of five terms: openssl enc, gpg --symmetric, gpg -c , base64 , xxd -p. selection_target is a second contains list of five path prefixes — /etc/, /home/, /root/, /srv/, /var/www/. filter_reverse subtracts -d , --decode and --decrypt, because decoding is the reverse behaviour and belongs to T1140. Three shapes defeat it, and they are ordinary rather than exotic. A pipeline — tar czf - /home | openssl enc -aes-256-cbc — leaves no path in openssl's own argv. Data held in a variable or heredoc never touches a path either. And a relative path defeats the target block entirely: cd /etc && base64 shadow contains no /etc/ substring, even though CurrentDirectory on the event holds exactly what the rule wants. Two narrower gaps are worth knowing: openssl accepts a cipher name directly, so openssl aes-256-cbc -in /etc/shadow carries no enc token, and the trailing space in base64 means the tool as the last word of a line — cat /etc/shadow | base64 — never matches.

04 · Common false positives

Legitimate encryption of exactly these paths is routine. Backup jobs that encrypt a copy of /etc or /home before shipping it offsite are the loudest match on any fileserver, which is why the level is low. Then CI/CD and provisioning runs base64-encoding certs, kubeconfigs and SSH keys out of /etc/ssl and ~/.ssh; hosting panels gpg-encrypting customer data under /home once per account per night; and admins base64-ing a config file to paste it into a ticket. After filter_reverse, the surviving population is dominated by those first two, so treat this as a hunt or baseline query — an inventory of who encrypts data on this host — and read the outliers, not the hit count.

05 · Detection maturity

tier_1: Lowest tier, and it stays there until the rule has been run against real data. Nothing here has fired once; the false-positive ranking above is reasoning, not measurement. Run it over a week of history, count what it returns, then decide.

Tuning & false positivesexperimental · 4 declared

experimental (current stage)
test
stable

Written and reasoned about, but not yet run against real telemetry. Expect to tune it before trusting it.

Tuning tips

AN1065 gives two knobs, CommandRegex and SensitivePathList, and this rule populates them. MITRE's analytic text names gzip, base64, tar and openssl, and gives /etc/ and /home/ as example paths. Everything else is the pipeline's own: symmetric gpg and xxd were added here, and /root, /srv and /var/www were added here. Going the other way, gzip and tar were deliberately dropped — on any real host they would supply nearly every match. Your first tuning move is the same trade in reverse: add the tools your estate actually uses, and cut paths whose backup jobs you already know about.

Declared by the author

Backup and archiving jobs that encrypt a copy of /etc or /home before shipping it offsite. Hand-written cron wrappers around openssl enc and gpg --symmetric are the classic form, and on a fileserver they are the loudest match this rule has, which is why it is scored low.
CI/CD and provisioning runs — Ansible, cloud-init, GitLab runners — that base64-encode certificates, kubeconfigs or SSH keys out of /etc/ssl or a user's /home/<user>/.ssh so they survive being passed between stages.
Hosting control panels such as cPanel and Plesk, whose scheduled account backups gpg-encrypt customer data under /home before upload, once per account per night.
Administrators and support staff encoding a config file under /etc with base64 to paste it into a ticket or chat without line-wrapping damage.

Noise check0 of 4 fired

Fires on none of the 4 ordinary behaviours the baseline holds for this log type. That is not a precision guarantee: it means only not caught by these 4 behaviours, and the next ordinary behaviour nobody wrote down may still match.

Run live against 65 hand-written events of ordinary corporate activity — backup agents, software distribution, patching, helpdesk scripts, EDR. It says nothing about how often the rule would fire in production, which is the number that actually exhausts an analyst.

Verification1 run

Not verified

Siemphony benign baseline
completed
Siemphony IR · 3 Sept 2026
No events matched, so this run proves nothing either way.

Test it yourselfin your browser

Runs here in your browser against public attack recordings. A preview — not the verification badge.

Recordings of T1027, evaluated against their process_creation events.

Share this rule

/u/siemphony/d1ed6f77-f8b4-4ac3-b6e2-f1e8e72bdcef

More from this repertoire

All compositions

Verdicts · reactions · comments

Community

Verdicts from engineers who actually deployed it, and the conversation around it.

Not yet reported on

Nobody has run this in a real environment and said what happened.

Verdicts from engineers who deployed it

0 cast

No verdicts reported yet. The first one is worth more than the tenth — say what you ran it against.

No comments yet. Someone who deploys this will have something to say about it.

Detect encoding or encryption of files under sensitive paths

The detection

detection.yml

Sentinel · KQL

Splunk · SPL

Elastic · ES|QL

Wazuh · XML rule

Community

Verdicts from engineers who deployed it