Live Active security incident? Get immediate response
MITRE ATT&CK® Technique

T1027.009: Embedded Payloads

Adversaries may embed payloads within other files to conceal malicious content from defenses. Otherwise seemingly benign files (such as scripts and executables) may be abused to carry and obfuscate malicious payloads and content. In some cases, embedded payloads may also enable adversaries to Subvert Trust Controls by not impacting execution controls such as digital signatures and notarization tickets.[1]

Adversaries may embed payloads in various file formats to hide payloads.[2] This is similar to Steganography, though does not involve weaving malicious content into specific bytes and patterns related to legitimate digital media formats.[3]

For example, adversaries have been observed embedding payloads within or as an overlay of an otherwise benign binary.[4] Adversaries have also been observed nesting payloads (such as executables and run-only scripts) inside a file of the same format.[5]

Embedded content may also be used as Process Injection payloads used to infect benign system processes.[6] These embedded then injected payloads may be used as part of the modules of malware designed to provide specific features such as encrypting C2 communications in support of an orchestrator module. For example, an embedded module may be injected into default browsers, allowing adversaries to then communicate via the network.[7]

EnterpriseT1027.009Sub-techniqueObject v2.0 Modified
Discuss defensive coverage Back to ATT&CK
Glexia's Take

Analyst context for executives and security teams

Analyst confidence High

Embedded Payloads matter because malicious content can be hidden inside files that look acceptable to users, tools, or trust controls. For leaders, the risk is not the file format itself; it is whether endpoint, malware analysis, and incident response processes can reveal what a file carries and what it loads or injects at runtime across Windows, macOS, and Linux environments.

Executive priority

Prioritize this as a defense-evasion control validation issue. The ATT&CK relationships show use across multiple campaigns, groups, and malware families, including examples involving supply chain compromise, ransomware, wipers, spyware, backdoors, and macOS AppleScript nesting. Executives should ask whether signed, notarized, or otherwise trusted-looking files receive enough behavioral scrutiny, and whether SOC and IR teams can preserve and analyze suspicious parent files, embedded content, and runtime behavior as audit-ready evidence.

Technical view

This is a sub-technique of T1027 Obfuscated Files or Information under the stealth tactic. ATT&CK lists Linux, macOS, and Windows platforms and describes payloads embedded in scripts, executables, overlays, same-format nested files, images, shortcut-related structures, and modules later used for process injection. Because no official ATT&CK detection text is provided for this object, defenders should validate coverage through the related DET0214 detection strategy, endpoint behavior prevention, antimalware analysis, and runtime telemetry that connects unusual file structure to execution, script interpretation, process injection, or network activity.

Likely telemetry

  • Endpoint file creation, modification, and execution events for scripts, executables, shortcuts, images, and other carrier files
  • Antivirus/antimalware and endpoint behavior-prevention alerts, including heuristic or behavioral findings
  • File metadata and static-analysis evidence such as overlays, appended data, nested same-format content, anomalous sections, or embedded resources
  • Script interpreter activity, including PowerShell and AppleScript where present in the environment
  • Process lineage showing a benign-looking file leading to interpreter execution, module loading, process injection, or browser/process abuse

Detection direction

  • Validate DET0214-aligned analytics against both static indicators of embedded content and behavioral evidence after execution; static file inspection alone may miss payloads that only emerge at runtime.
  • Tune detections around suspicious parent-child process chains, embedded payload extraction, interpreter launch, process injection, and unexpected network activity from otherwise benign-looking files.
  • Treat trusted-looking files, signed binaries, notarized macOS content, or common document/image/script containers as detection blind spots if controls only rely on reputation or signatures.
  • Use relationship context to test visibility across Windows, macOS, and Linux rather than assuming coverage from one operating system generalizes to another.
  • Manage false positives by baselining legitimate installers, packagers, scripts, and enterprise software that may contain appended or embedded resources, then requiring suspicious execution or behavioral context for escalation.

Mitigation priorities

  • Ensure antivirus/antimalware coverage is deployed, updated, and configured to inspect suspicious files and behaviors across supported endpoint platforms.
  • Prioritize M1040 Behavior Prevention on Endpoint controls that can block suspicious process behavior, script execution patterns, API activity, and runtime anomalies rather than relying only on known signatures.
  • Require suspicious carrier files to be retained for analysis so IR teams can extract and compare embedded payloads with observed process and network behavior.
  • Review trust-control assumptions: signed, notarized, or approved-looking files should still be subject to behavioral monitoring when they spawn interpreters, inject into processes, or initiate unusual communications.
  • Use this technique in detection engineering and tabletop exercises for supply chain, ransomware, wiper, spyware, and backdoor scenarios reflected in the ATT&CK relationship set.
Analyst notes and limits

The most useful defensive question is whether the organization can connect three pieces of evidence: the carrier file, the hidden or appended payload, and the runtime behavior that payload produces. The relationship set is broad, including C0021, the 3CX Supply Chain Attack, Lazarus Group, Moonstone Sleet, TA577, and software such as Uroburos, ComRAT, Invoke-PSImage, Emotet, Netwalker, IcedID, Dtrack, SMOKEDHAM, macOS.OSAMiner, DEADEYE, BADHATCH, DEADWOOD, MultiLayer Wiper, Moneybird, and Pikabot. Use that context for defensive validation, not as proof of local exposure.

ATT&CK provides no official detection text for this object, so detection recommendations are derived from the official description and supplied relationships, especially DET0214, M1040, and M1049. Local file types, operating systems, EDR depth, script logging, memory visibility, and malware-analysis capability will determine practical coverage.

Official MITRE ATT&CK definition

Embedded Payloads

Adversaries may embed payloads within other files to conceal malicious content from defenses. Otherwise seemingly benign files (such as scripts and executables) may be abused to carry and obfuscate malicious payloads and content. In some cases, embedded payloads may also enable adversaries to Subvert Trust Controls by not impacting execution controls such as digital signatures and notarization tickets.[1]

Adversaries may embed payloads in various file formats to hide payloads.[2] This is similar to Steganography, though does not involve weaving malicious content into specific bytes and patterns related to legitimate digital media formats.[3]

For example, adversaries have been observed embedding payloads within or as an overlay of an otherwise benign binary.[4] Adversaries have also been observed nesting payloads (such as executables and run-only scripts) inside a file of the same format.[5]

Embedded content may also be used as Process Injection payloads used to infect benign system processes.[6] These embedded then injected payloads may be used as part of the modules of malware designed to provide specific features such as encrypting C2 communications in support of an orchestrator module. For example, an embedded module may be injected into default browsers, allowing adversaries to then communicate via the network.[7]

View the same entry on attack.mitre.org (MITRE-hosted reference; in-page links above use the Glexia ATT&CK library.)

Glexia analysis

How security teams should use this page

Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.

ATT&CK relationship table

Related techniques

This mirrors the MITRE pattern of making group, software, campaign, and technique relationships scannable. Relationship notes come from mirrored ATT&CK relationship text when available.

1 rows
Domain ID Name Relationship / procedure
Enterprise T1027 Obfuscated Files or Information This object subtechnique of Obfuscated Files or Information.
Associated objects

Groups, software, and campaigns

Group Enterprise

G0032: Lazarus Group

Lazarus Group is a North Korean state-sponsored cyber threat group attributed to the Reconnaissance General Bureau (RGB). [1] [2] Lazarus Group has been active since at least 2009 and is reportedly responsible for the November 2014 destructive wiper attack on Sony Pictures Entertainment, identified by Novetta as part of Operation Blockbuster. Malware used by Lazarus Group correlates to other reported campaigns, including Operation Flame, Operation 1Mission, Operation Troy, DarkSeoul, and Ten Days of Rain.[3]

North Korea’s cyber operations have shown a consistent pattern of adaptation, forming and reorganizing units as national priorities shift. These units frequently share personnel, infrastructure, malware, and tradecraft, making it difficult to attribute specific operations with high confidence. Public reporting often uses “Lazarus Group” as an umbrella term for multiple North Korean cyber operators conducting espionage, destructive attacks, and financially motivated campaigns.[4][5][6]

Group Enterprise

G1036: Moonstone Sleet

Moonstone Sleet is a North Korean-linked threat actor executing both financially motivated attacks and espionage operations. The group previously overlapped significantly with another North Korean-linked entity, Lazarus Group, but has differentiated its tradecraft since 2023. Moonstone Sleet is notable for creating fake companies and personas to interact with victim entities, as well as developing unique malware such as a variant delivered via a fully functioning game.[1]

Malware Enterprise

S1137: Moneybird

Moneybird is a ransomware variant written in C++ associated with Agrius operations. The name "Moneybird" is contained in the malware's ransom note and as strings in the executable.[1]

Windows
Malware Enterprise

S1052: DEADEYE

DEADEYE is a malware launcher that has been used by APT41 since at least May 2021. DEADEYE has variants that can either embed a payload inside a compiled binary (DEADEYE.EMBED) or append it to the end of a file (DEADEYE.APPEND).[1]

Windows
Malware Enterprise

S1081: BADHATCH

BADHATCH is a backdoor that has been utilized by FIN8 since at least 2019. BADHATCH has been used to target the insurance, retail, technology, and chemical industries in the United States, Canada, South Africa, Panama, and Italy.[1][2]

Windows
Malware Enterprise

S1134: DEADWOOD

DEADWOOD is wiper malware written in C++ using Boost libraries. DEADWOOD was first observed in an unattributed wiping event in Saudi Arabia in 2019, and has since been incorporated into Agrius operations.[1]

Windows
Malware Enterprise

S0367: Emotet

Emotet is a modular malware variant which is primarily used as a downloader for other malware variants such as TrickBot and IcedID. Emotet first emerged in June 2014, initially targeting the financial sector, and has expanded to multiple verticals over time.[1]

Windows
Malware Enterprise

S1048: macOS.OSAMiner

macOS.OSAMiner is a Monero mining trojan that was first observed in 2018; security researchers assessed macOS.OSAMiner may have been circulating since at least 2015. macOS.OSAMiner is known for embedding one run-only AppleScript into another, which helped the malware evade full analysis for five years due to a lack of Apple event (AEVT) analysis tools.[1][2]

macOS
Malware Enterprise

S0567: Dtrack

Dtrack is spyware that was discovered in 2019 and has been used against Indian financial institutions, research facilities, and the Kudankulam Nuclear Power Plant. Dtrack shares similarities with the DarkSeoul campaign, which was attributed to Lazarus Group. [1][2][3][4][5]

Windows
Malware Enterprise

S0483: IcedID

IcedID is a modular banking malware designed to steal financial information that has been observed in the wild since at least 2017. IcedID has been downloaded by Emotet in multiple campaigns.[1][2]

Windows
Malware Enterprise

S0649: SMOKEDHAM

SMOKEDHAM is a Powershell-based .NET backdoor that was first reported in May 2021; it has been used by at least one ransomware-as-a-service affiliate.[1][2]

Windows
Campaign Enterprise

C0057: 3CX Supply Chain Attack

The 3CX Supply Chain Attack was the first publicly reported case of one supply chain compromise triggering another, leading to a cascading, two-stage intrusion. The initial supply chain attack began when a 3CX employee downloaded and executed a trojanized, end-of-life version of the X_Trader trading software from Trading Technologies. This provided UNC4736, a threat cluster associated with AppleJeus, access to the 3CX environment. From there UNC4736 compromised the Windows and macOS build environments used to distribute the 3CX desktop application to their customers.[1] While 3CX serves more than 600,000 customers and 12 million users, only a subset of systems were affected. Subsequent targeting focused on victims in the defense and cryptocurrency sectors, where attackers deployed secondary payloads such as Gopuram for credential theft and persistence.[2] The campaign began in late 2022 and was disrupted after security vendors publicly reported the compromise in March 2023.[3][4]

Campaign Enterprise

C0021: C0021

C0021 was a spearphishing campaign conducted in November 2018 that targeted public sector institutions, non-governmental organizations (NGOs), educational institutions, and private-sector corporations in the oil and gas, chemical, and hospitality industries. The majority of targets were located in the US, particularly in and around Washington D.C., with other targets located in Europe, Hong Kong, India, and Canada. C0021's technical artifacts, tactics, techniques, and procedures (TTPs), and targeting overlap with previous suspected APT29 activity.[1][2]

Relationship explorer

All related ATT&CK context

uses · Malware S1137: Moneybird Enterprise subtechnique of · Technique T1027: Obfuscated Files or Information Enterprise mitigates · Mitigation M1049: Antivirus/Antimalware Enterprise uses · Malware S1052: DEADEYE Enterprise uses · Group G0032: Lazarus Group Enterprise uses · Malware S1081: BADHATCH Enterprise uses · Malware S1149: CHIMNEYSWEEP Enterprise uses · Malware S1134: DEADWOOD Enterprise uses · Malware S0367: Emotet Enterprise uses · Malware S1048: macOS.OSAMiner Enterprise detects · Detection Strategy DET0214: Detection Strategy for Embedded Payloads Enterprise uses · Malware S0567: Dtrack Enterprise uses · Malware S0483: IcedID Enterprise uses · Malware S0457: Netwalker Enterprise uses · Malware S1135: MultiLayer Wiper Enterprise uses · Malware S0649: SMOKEDHAM Enterprise uses · Malware S1145: Pikabot Enterprise mitigates · Mitigation M1040: Behavior Prevention on Endpoint Enterprise uses · Campaign C0057: 3CX Supply Chain Attack Enterprise uses · Group G1037: TA577 Enterprise uses · Malware S0126: ComRAT Enterprise uses · Malware S1158: DUSTPAN Enterprise uses · Malware S1159: DUSTTRAP Enterprise uses · Tool S0231: Invoke-PSImage Enterprise
Mitigations

Mitigation direction

Mitigation Enterprise

M1049: Antivirus/Antimalware

Antivirus/Antimalware solutions utilize signatures, heuristics, and behavioral analysis to detect, block, and remediate malicious software, including viruses, trojans, ransomware, and spyware. These solutions continuously monitor endpoints and systems for known malicious patterns and suspicious behaviors that indicate compromise. Antivirus/Antimalware software should be deployed across all devices, with automated updates to ensure protection against the latest threats. This mitigation can be implemented through the following measures:

Signature-Based Detection:

- Implementation: Use predefined signatures to identify known malware based on unique patterns such as file hashes, byte sequences, or command-line arguments. This method is effective against known threats. - Use Case: When malware like "Emotet" is detected, its signature (such as a specific file hash) matches a known database of malicious software, triggering an alert and allowing immediate quarantine of the infected file.

Heuristic-Based Detection:

- Implementation: Deploy heuristic algorithms that analyze behavior and characteristics of files and processes to identify potential malware, even if it doesn’t match a known signature. - Use Case: If a program attempts to modify multiple critical system files or initiate suspicious network communications, heuristic analysis may flag it as potentially malicious, even if no specific malware signature is available.

Behavioral Detection (Behavior Prevention):

- Implementation: Use behavioral analysis to detect patterns of abnormal activities, such as unusual system calls, unauthorized file encryption, or attempts to escalate privileges. - Use Case: Behavioral analysis can detect ransomware attacks early by identifying behavior like mass file encryption, even before a specific ransomware signature has been identified.

Real-Time Scanning:

- Implementation: Enable real-time scanning to automatically inspect files and network traffic for signs of malware as they are accessed, downloaded, or executed. - Use Case: When a user downloads an email attachment, the antivirus solution scans the file in real-time, checking it against both signatures and heuristics to detect any malicious content before it can be opened.

Cloud-Assisted Threat Intelligence:

- Implementation: Use cloud-based threat intelligence to ensure the antivirus solution can access the latest malware definitions and real-time threat feeds from a global database of emerging threats. - Use Case: Cloud-assisted antivirus solutions quickly identify newly discovered malware by cross-referencing against global threat databases, providing real-time protection against zero-day attacks.

**Tools for Implementation**:

- Endpoint Security Platforms: Use solutions such as EDR for comprehensive antivirus/antimalware protection across all systems. - Centralized Management: Implement centralized antivirus management consoles that provide visibility into threat activity, enable policy enforcement, and automate updates. - Behavioral Analysis Tools: Leverage solutions with advanced behavioral analysis capabilities to detect malicious activity patterns that don’t rely on known signatures.

Mitigation Enterprise

M1040: Behavior Prevention on Endpoint

Behavior Prevention on Endpoint refers to the use of technologies and strategies to detect and block potentially malicious activities by analyzing the behavior of processes, files, API calls, and other endpoint events. Rather than relying solely on known signatures, this approach leverages heuristics, machine learning, and real-time monitoring to identify anomalous patterns indicative of an attack. This mitigation can be implemented through the following measures:

Suspicious Process Behavior:

- Implementation: Use Endpoint Detection and Response (EDR) tools to monitor and block processes exhibiting unusual behavior, such as privilege escalation attempts. - Use Case: An attacker uses a known vulnerability to spawn a privileged process from a user-level application. The endpoint tool detects the abnormal parent-child process relationship and blocks the action.

Unauthorized File Access:

- Implementation: Leverage Data Loss Prevention (DLP) or endpoint tools to block processes attempting to access sensitive files without proper authorization. - Use Case: A process tries to read or modify a sensitive file located in a restricted directory, such as /etc/shadow on Linux or the SAM registry hive on Windows. The endpoint tool identifies this anomalous behavior and prevents it.

Abnormal API Calls:

- Implementation: Implement runtime analysis tools to monitor API calls and block those associated with malicious activities. - Use Case: A process dynamically injects itself into another process to hijack its execution. The endpoint detects the abnormal use of APIs like `OpenProcess` and `WriteProcessMemory` and terminates the offending process.

Exploit Prevention:

- Implementation: Use behavioral exploit prevention tools to detect and block exploits attempting to gain unauthorized access. - Use Case: A buffer overflow exploit is launched against a vulnerable application. The endpoint detects the anomalous memory write operation and halts the process.

Change history

Object version and sync metadata

The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates .

ATT&CK release
19.1
Object version
2.0
Created
Modified
Raw hash
811d5c68c86c7bbd...
Imported snapshots across ATT&CK releases (1)
Release Bundle imported Object version Modified Status Raw hash
19.1 2.0 Current bundle 811d5c68c86c…
Raw source

Mirrored ATT&CK source object

The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.

Open mirrored raw JSON Open MITRE-hosted copy
Source references

External references and citations

MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.

  1. [1]
    Sentinel Labs

    Phil Stokes. (2021, January 11). FADE DEAD | Adventures in Reversing Malicious Run-Only AppleScripts. Retrieved September 30, 2022.

    Open source URL
  2. [2]
    Microsoft Learn

    Microsoft. (2021, April 6). 2.5 ExtraData. Retrieved September 30, 2022.

    Open source URL
  3. [3]
    GitHub PSImage

    Barrett Adams . (n.d.). Invoke-PSImage . Retrieved September 30, 2022.

    Open source URL
  4. [4]
    Securelist Dtrack2

    KONSTANTIN ZYKOV. (2019, September 23). Hello! My name is Dtrack. Retrieved September 30, 2022.

    Open source URL
  5. [5]
    SentinelLabs reversing run-only applescripts 2021

    Phil Stokes. (2021, January 11). FADE DEAD | Adventures in Reversing Malicious Run-Only AppleScripts. Retrieved September 29, 2022.

    Open source URL
  6. [6]
    Trend Micro

    Karen Victor. (2020, May 18). Reflective Loading Runs Netwalker Fileless Ransomware. Retrieved September 30, 2022.

    Open source URL
  7. [7]
    Malware Analysis Report ComRAT

    CISA. (2020, October 29). Malware Analysis Report (AR20-303A) MAR-10310246-2.v1 – PowerShell Script: ComRAT. Retrieved September 30, 2022.

    Open source URL
  8. [8]
    mitre-attack T1027.009
    Open source URL
Source and licensing

Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.

Official MITRE ATT&CK site Official STIX data repository MITRE ATT&CK terms of use