Merge pull request #12 from redcanaryco/atomic-dev-cs

Atomic dev cs

Windows/Defense Evasion/Deobfuscate_Decode_Files_Or_Information.md

@@ -0,0 +1,9 @@
+# Deobfuscate/Decode Files Or Information
+
+MITRE ATT&CK Technique: [T1140](https://attack.mitre.org/wiki/Technique/T1140)
+
+## Example encode executable
+    certutil.exe -encode file.exe file.txt
+
+## Example decode executable
+    certutil.exe -decode file.txt file.exe