T1027.009
Obfuscated Files or Information: Embedded Payloads
Description from ATT&CK
Adversaries may embed payloads within other files to conceal malicious content from defenses. Otherwise seemingly benign files (such as scripts and executables) may be abused to carry and obfuscate malicious payloads and content. In some cases, embedded payloads may also enable adversaries to Subvert Trust Controls by not impacting execution controls such as digital signatures and notarization tickets.(Citation: Sentinel Labs)
Adversaries may embed payloads in various file formats to hide payloads.(Citation: Microsoft Learn) This is similar to Steganography, though does not involve weaving malicious content into specific bytes and patterns related to legitimate digital media formats.(Citation: GitHub PSImage)
For example, adversaries have been observed embedding payloads within or as an overlay of an otherwise benign binary.(Citation: Securelist Dtrack2) Adversaries have also been observed nesting payloads (such as executables and run-only scripts) inside a file of the same format.(Citation: SentinelLabs reversing run-only applescripts 2021)
Embedded content may also be used as Process Injection payloads used to infect benign system processes.(Citation: Trend Micro) These embedded then injected payloads may be used as part of the modules of malware designed to provide specific features such as encrypting C2 communications in support of an orchestrator module. For example, an embedded module may be injected into default browsers, allowing adversaries to then communicate via the network.(Citation: Malware Analysis Report ComRAT)
Atomic Tests
- Atomic Test #1: Embed Simulated Payload Overlay in Carrier Executable
- Atomic Test #2: Embed Simulated Payload Data in Carrier Image File
- Atomic Test #3: Embed Simulated Payload Data in Carrier PDF File
- Atomic Test #4: Embed Base64 Payload String in INI Configuration File
- Atomic Test #5: Embed Base64 Payload String in JSON Configuration File
- Atomic Test #6: Embed Base64 Payload String in XML Resource File
- Atomic Test #7: Embed Base64 Payload String in CSV Data File
- Atomic Test #8: Embed Base64 Payload String in PowerShell Script Carrier
- Atomic Test #9: Embed Base64 Payload String in Windows Script File Carrier
- Atomic Test #10: Embed Hex-Encoded Simulated Shellcode String in Text Carrier
Atomic Test #1: Embed Simulated Payload Overlay in Carrier Executable
Simulates an adversary appending non-executing payload data as an overlay to a carrier executable file. The appended data is not executed.
Supported Platforms: Windows
auto_generated_guid: 09b8f49c-58b8-49f4-bec7-d80d9163fb5c
Inputs
| Name | Description | Type | Default Value |
|---|---|---|---|
| carrier_path | Path to the carrier executable file | path | $env:TEMP\T1027_009_carrier.exe |
| embedded_payload | Simulated non-executing payload data appended to the carrier | string | TVqQAAMAAAAEAAAA//8A |
Attack Commands: Run with powershell!
if (Test-Path "#{carrier_path}") { Remove-Item "#{carrier_path}" -Force -ErrorAction SilentlyContinue }
[System.IO.File]::WriteAllBytes("#{carrier_path}", [byte[]](0..127))
[System.IO.File]::AppendAllText("#{carrier_path}", "#{embedded_payload}")
Write-Host "Embedded payload overlay appended to #{carrier_path}"Cleanup Commands
Remove-Item "#{carrier_path}" -Force -ErrorAction SilentlyContinueAtomic Test #2: Embed Simulated Payload Data in Carrier Image File
Simulates an adversary appending non-executing payload data beyond the declared content of a carrier image file. The payload is not executed.
Supported Platforms: Windows
auto_generated_guid: 4f37ebea-bfaa-41c7-97bd-08bba0b8855d
Inputs
| Name | Description | Type | Default Value |
|---|---|---|---|
| carrier_path | Path to the carrier image file | path | $env:TEMP\T1027_009_carrier.png |
| embedded_payload | Simulated non-executing payload data appended to the image | string | TVqQAAMAAAAEAAAA//8A |
Attack Commands: Run with powershell!
if (Test-Path "#{carrier_path}") { Remove-Item "#{carrier_path}" -Force -ErrorAction SilentlyContinue }
[System.IO.File]::WriteAllBytes("#{carrier_path}", [byte[]](137,80,78,71,13,10,26,10,0,0,0,13))
[System.IO.File]::AppendAllText("#{carrier_path}", "#{embedded_payload}")
Write-Host "Embedded payload data appended to #{carrier_path}"Cleanup Commands
Remove-Item "#{carrier_path}" -Force -ErrorAction SilentlyContinueAtomic Test #3: Embed Simulated Payload Data in Carrier PDF File
Simulates an adversary appending non-executing payload data beyond the declared content of a carrier PDF document. The payload is not executed.
Supported Platforms: Windows
auto_generated_guid: 53b9902a-5ba5-4217-93e7-5d5571d163b4
Inputs
| Name | Description | Type | Default Value |
|---|---|---|---|
| carrier_path | Path to the carrier PDF file | path | $env:TEMP\T1027_009_carrier.pdf |
| embedded_payload | Simulated non-executing payload data appended to the PDF | string | TVqQAAMAAAAEAAAA//8A |
Attack Commands: Run with powershell!
if (Test-Path "#{carrier_path}") { Remove-Item "#{carrier_path}" -Force -ErrorAction SilentlyContinue }
[System.IO.File]::WriteAllBytes("#{carrier_path}", [byte[]](37,80,68,70,45,49,46,52,10))
[System.IO.File]::AppendAllText("#{carrier_path}", "#{embedded_payload}")
Write-Host "Embedded payload data appended to #{carrier_path}"Cleanup Commands
Remove-Item "#{carrier_path}" -Force -ErrorAction SilentlyContinueAtomic Test #4: Embed Base64 Payload String in INI Configuration File
Simulates an adversary embedding a Base64-encoded payload string within an otherwise benign INI configuration file.
Supported Platforms: Windows
auto_generated_guid: 1920a80e-7376-4d9f-afe9-1c7f8b0882ba
Inputs
| Name | Description | Type | Default Value |
|---|---|---|---|
| config_path | Path to the INI configuration carrier file | path | $env:TEMP\T1027_009_settings.ini |
| embedded_payload | Base64-encoded simulated payload string | string | TVqQAAMAAAAEAAAA//8A |
Attack Commands: Run with powershell!
$configContent = @"
[Settings]
application=legitimate-application
update_url=https://example.invalid
embedded_payload=#{embedded_payload}
"@
Set-Content -Path "#{config_path}" -Value $configContent -Force
Write-Host "Base64 payload string embedded in #{config_path}"Cleanup Commands
Remove-Item "#{config_path}" -Force -ErrorAction SilentlyContinueAtomic Test #5: Embed Base64 Payload String in JSON Configuration File
Simulates an adversary embedding a Base64-encoded payload string within an otherwise benign JSON configuration file.
Supported Platforms: Windows
auto_generated_guid: 025544b0-07ab-4fa3-97b3-17da2343a5eb
Inputs
| Name | Description | Type | Default Value |
|---|---|---|---|
| config_path | Path to the JSON configuration carrier file | path | $env:TEMP\T1027_009_settings.json |
| embedded_payload | Base64-encoded simulated payload string | string | TVqQAAMAAAAEAAAA//8A |
Attack Commands: Run with powershell!
$json = @{
application = "legitimate-application"
update_url = "https://example.invalid"
embedded_payload = "#{embedded_payload}"
} | ConvertTo-Json
Set-Content -Path "#{config_path}" -Value $json -Force
Write-Host "Base64 payload string embedded in #{config_path}"Cleanup Commands
Remove-Item "#{config_path}" -Force -ErrorAction SilentlyContinueAtomic Test #6: Embed Base64 Payload String in XML Resource File
Simulates an adversary embedding a Base64-encoded payload string within an otherwise benign XML resource file.
Supported Platforms: Windows
auto_generated_guid: 75edafa4-60c0-45bb-8900-d0805d9f029f
Inputs
| Name | Description | Type | Default Value |
|---|---|---|---|
| resource_path | Path to the XML resource carrier file | path | $env:TEMP\T1027_009_resource.xml |
| embedded_payload | Base64-encoded simulated payload string | string | TVqQAAMAAAAEAAAA//8A |
Attack Commands: Run with powershell!
$xmlContent = @"
<?xml version="1.0" encoding="utf-8"?>
<configuration>
<application>legitimate-application</application>
<embeddedPayload>#{embedded_payload}</embeddedPayload>
</configuration>
"@
Set-Content -Path "#{resource_path}" -Value $xmlContent -Force
Write-Host "Base64 payload string embedded in #{resource_path}"Cleanup Commands
Remove-Item "#{resource_path}" -Force -ErrorAction SilentlyContinueAtomic Test #7: Embed Base64 Payload String in CSV Data File
Simulates an adversary embedding a Base64-encoded payload string within a metadata field of an otherwise benign CSV data file.
Supported Platforms: Windows
auto_generated_guid: 82084e9b-6e80-43b5-8716-5d6b36579f53
Inputs
| Name | Description | Type | Default Value |
|---|---|---|---|
| csv_path | Path to the CSV data carrier file | path | $env:TEMP\T1027_009_export.csv |
| embedded_payload | Base64-encoded simulated payload string | string | TVqQAAMAAAAEAAAA//8A |
Attack Commands: Run with powershell!
$csvContent = @"
id,name,metadata
1,legitimate-record,#{embedded_payload}
"@
Set-Content -Path "#{csv_path}" -Value $csvContent -Force
Write-Host "Base64 payload string embedded in #{csv_path}"Cleanup Commands
Remove-Item "#{csv_path}" -Force -ErrorAction SilentlyContinueAtomic Test #8: Embed Base64 Payload String in PowerShell Script Carrier
Simulates an adversary embedding a Base64-encoded payload string within a PowerShell script file. The script is created but not executed.
Supported Platforms: Windows
auto_generated_guid: 8112d9ba-fac8-41c3-9aa9-595246be967a
Inputs
| Name | Description | Type | Default Value |
|---|---|---|---|
| script_path | Path to the PowerShell script carrier file | path | $env:TEMP\T1027_009_carrier.ps1 |
| embedded_payload | Base64-encoded simulated payload string | string | TVqQAAMAAAAEAAAA//8A |
Attack Commands: Run with powershell!
$scriptContent = "# Simulated embedded payload carrier`r`n" +
"`$embeddedPayload = '#{embedded_payload}'"
Set-Content -Path "#{script_path}" -Value $scriptContent -Force
Write-Host "Base64 payload string embedded in #{script_path}"Cleanup Commands
Remove-Item "#{script_path}" -Force -ErrorAction SilentlyContinueAtomic Test #9: Embed Base64 Payload String in Windows Script File Carrier
Simulates an adversary embedding a Base64-encoded payload string within a Windows Script File. The script file is created but not executed.
Supported Platforms: Windows
auto_generated_guid: f989c010-dc48-41e7-83b8-a0b781e76a0f
Inputs
| Name | Description | Type | Default Value |
|---|---|---|---|
| script_path | Path to the Windows Script File carrier | path | $env:TEMP\T1027_009_carrier.wsf |
| embedded_payload | Base64-encoded simulated payload string | string | TVqQAAMAAAAEAAAA//8A |
Attack Commands: Run with powershell!
$wsfContent = @"
<?xml version="1.0" encoding="utf-8"?>
<job>
<script language="VBScript">
Const embeddedPayload = "#{embedded_payload}"
</script>
</job>
"@
Set-Content -Path "#{script_path}" -Value $wsfContent -Force
Write-Host "Base64 payload string embedded in #{script_path}"Cleanup Commands
Remove-Item "#{script_path}" -Force -ErrorAction SilentlyContinueAtomic Test #10: Embed Hex-Encoded Simulated Shellcode String in Text Carrier
Simulates an adversary embedding a hexadecimal representation of simulated shellcode within an otherwise benign text file. The shellcode representation is not decoded or executed.
Supported Platforms: Windows
auto_generated_guid: a50df5f9-8961-4e0c-bb62-bf0614ddae94
Inputs
| Name | Description | Type | Default Value |
|---|---|---|---|
| text_path | Path to the text carrier file | path | $env:TEMP\T1027_009_notes.txt |
| embedded_payload | Hex-encoded simulated shellcode representation | string | 9090909031c050682f2f7368 |
Attack Commands: Run with powershell!
$textContent = @"
Meeting notes
Reference: #{embedded_payload}
"@
Set-Content -Path "#{text_path}" -Value $textContent -Force
Write-Host "Hex-encoded simulated shellcode string embedded in #{text_path}"Cleanup Commands
Remove-Item "#{text_path}" -Force -ErrorAction SilentlyContinueAtomic test(s) for this technique last updated: 2026-11-02 18:13:22 UTC