Technique:  Obfuscated Files or Information:Command Obfuscation
It used Base64 to obfuscate executed commands.
It has used the Invoke-Obfuscation framework to obfuscate their PowerShell.
It has encoded PowerShell commands in Base64.
Astaroth has obfuscated and randomized parts of the JScript code it is initiating.
BackConfig has used compressed and decimal encoded VBS scripts.
BADHATCH malicious PowerShell commands can be encoded with base64.
During C0018, the threat actors used Base64 to encode their PowerShell scripts.
During C0021, the threat actors used encoded PowerShell commands.
CARROTBAT has the ability to execute obfuscated commands on the infected host.
It has encoded PowerShell commands.
It obfuscated several scriptlets and code used on the victim’s machine, including through use of XOR and RC4.
ComRAT has used encryption and base64 to obfuscate its orchestrator code in the Registry. ComRAT has also used encoded PowerShell scripts.
CookieMiner has used base64 encoding to obfuscate scripts on the system.
DarkWatchman has used Base64 to encode PowerShell commands.
Denis has encoded its PowerShell commands in Base64.
It has obfuscated malicious scripts to help avoid detection.
Emotet has obfuscated macros within malicious documents to hide the URLs hosting the malware,  CMD.exe arguments, and PowerShell scripts.
Empire has the ability to obfuscate commands using Invoke-Obfuscation.
It has used encoded PowerShell commands.
It has used fragmented strings, environment variables, standard input (stdin), and native character-replacement functionalities to obfuscate commands.
It has used environment variables and standard input (stdin) to obfuscate command-line arguments. It also obfuscates malicious macros delivered as payloads.
It has base64 encoded scripts to avoid detection.
During Frankenstein, the threat actors ran encoded commands from the command line.
FruitFly executes and stores obfuscated Perl scripts.
It has used obfuscated or encrypted scripts.
It has executed base64 encoded PowerShell scripts on compromised hosts.
It has used Base64-encoded scripts.
IceApple can use Base64 and "junk" JavaScript code to obfuscate information.
KOCTOPUS has obfuscated scripts with the BatchEncryption tool.
It has leveraged the BatchEncryption tool to perform advanced batch script obfuscation and encoding techniques.
It obfuscated scripts that were used on victim machines.
LoudMiner has obfuscated various scripts.
It has used pyobfuscate, zlib compression, and base64 encoding for obfuscation. It has also used some visual obfuscation techniques by naming variables as combinations of letters to hinder analysis.
It has used base64-encoded commands.
It has used Daniel Bohannon’s Invoke-Obfuscation framework and obfuscated PowerShell scripts. The group has also used other obfuscation methods, including Base64 obfuscation of VBScripts and PowerShell commands.
Netwalker's PowerShell script has been obfuscated with multiple layers including base64 and hexadecimal encoding and XOR-encryption, as well as obfuscated PowerShell functions and variables.
During Operation CuckooBees, the threat actors executed an encoded VBScript file.
During Operation Wocao, threat actors executed PowerShell commands which were encoded or compressed using Base64, zlib, and XOR.
It has obfuscated a script with Crypto Obfuscator.
PoetRAT has pyminifier to obfuscate scripts.
PowerPunch can use Base64-encoded scripts.
PowerSploit contains a collection of ScriptModification modules that compress and encode scripts and payloads.
POWERSTATS uses character replacement, PowerShell environment variables, and XOR encoding to obfuscate code. POWERSTATS's backdoor code is a multi-layer obfuscated, encoded, and compressed blob.  POWERSTATS has used PowerShell code with custom string obfuscation
QakBot can use obfuscated and encoded scripts.
QUADAGENT was likely obfuscated using Invoke-Obfuscation.
The PowerShell script with the RogueRobin payload was obfuscated using the COMPRESS technique in Invoke-Obfuscation.
It has used ROT13 encoding, AES encryption and compression with the zlib library for their Python-based backdoor.
Sardonic PowerShell scripts can be encrypted with RC4 and compressed using Gzip.
SHARPSTATS has used base64 encoding and XOR to obfuscate PowerShell scripts.
Sibot has obfuscated scripts used in execution.
It has used base64 encoding for scripts.
It has used environment variable string substitution for obfuscation.
SQLRat has used a character insertion obfuscation technique, making the script appear to contain Chinese characters.
It has used base64 encoded PowerShell commands.
It has used obfuscated variable names in a JavaScript configuration file.
It has used encryption (including salted 3DES via PowerSploit's Out-EncryptedScript.ps1), random variable names, and base64 encoding to obfuscate PowerShell commands and payloads.
Ursnif droppers execute base64 encoded PowerShell commands.
It used Base64 encoding to obfuscate an Empire service and PowerShell commands.
Zeus Panda obfuscates the macro commands in its initial payload.