AN0927 Analytic 0927

Windows · attack.mitre.org · ATT&CK Enterprise v19.2

<p>A process/script constructs or references a custom/alphabet translation table (e.g., 64/85/32+ arbitrary chars, XOR/base-N loops) or emits long high-entropy strings that do NOT validate as standard Base64/Hex → shortly after, the same process (or its child) generates outbound traffic with asymmetric bytes_out:bytes_in, fixed-size beacons, or protocol/header mismatches (e.g., Content-Type says JSON but body fails JSON parse / contains non-standard alphabet).</p>

Detects: T1132.002 Non-Standard Encoding
Part of: DET0326 Behavior-chain detection for T1132.002 Data Encoding: Non-Standard Encoding across Windows, Linux, macOS, ESXi

Log sources and channels

Exactly as MITRE states them in x_mitre_log_source_references. Where a channel is vague, it is vague in the source; kevmap does not tidy it.

Log source	Channel	Data component
WinEventLog:Security	`EventCode=4688`	DC0032 Process Creation
WinEventLog:Sysmon	`EventCode=3, 22`	DC0082 Network Connection Creation
WinEventLog:PowerShell	`EventCode=4103, 4104, 4105, 4106`	DC0029 Script Execution
m365:defender	`NetworkConnection: high out:in ratio, periodic beacons, protocol mismatch`	DC0078 Network Traffic Flow

Mutable elements

Parameters MITRE marks as environment-specific. These are the knobs you are expected to tune; they are why an analytic is not a rule.

Field	Description
`EntropyThreshold`	Minimum Shannon entropy for the suspected token/payload (e.g., >4.8).
`TokenLengthThreshold`	Minimum continuous token length to treat as potential non-standard payload (e.g., ≥120 chars).
`BytesOutToInRatio`	Out:In ratio considered suspicious (e.g., ≥4:1).
`FixedPacketStdDevThreshold`	Std. dev. threshold (size or interval) to mark packets as 'uniform' (beacon-like).
`TimeWindow`	Correlation window from encode routine to egress (default 10m).
`KnownLegitEncoders`	Legitimate in-house/custom encoders to suppress.