{"id":"T1132.002","name":"Non-Standard Encoding","url":"https://attack.mitre.org/techniques/T1132/002","tactics":["command-and-control"],"platforms":["ESXi","Linux","macOS","Windows"],"live":true,"revoked":false,"deprecated":false,"revoked_by":null,"detection_strategies":[{"id":"DET0326","stix_id":"x-mitre-detection-strategy--8bcafe59-0a4b-4314-988b-085bf5cdf7a9","name":"Behavior-chain detection for T1132.002 Data Encoding: Non-Standard Encoding across Windows, Linux, macOS, ESXi","url":"https://attack.mitre.org/detectionstrategies/DET0326","analytics":[{"id":"AN0927","stix_id":"x-mitre-analytic--b8dea721-8e0d-4bcd-bde4-6609afd595e5","name":"Analytic 0927","description":"A process/script constructs or references a custom/alphabet translation table (e.g., 64/85/32+ arbitrary chars, XOR/base-N loops) or emits long high-entropy strings that do NOT validate as standard Base64/Hex → shortly after, the same process (or its child) generates outbound traffic with asymmetric bytes_out:bytes_in, fixed-size beacons, or protocol/header mismatches (e.g., Content-Type says JSON but body fails JSON parse / contains non-standard alphabet).","url":"https://attack.mitre.org/detectionstrategies/DET0326#AN0927","platforms":["Windows"],"log_source_references":[{"name":"WinEventLog:Security","channel":"EventCode=4688","data_component":"DC0032","data_component_name":"Process Creation","log_source_slug":"wineventlog-security"},{"name":"WinEventLog:Sysmon","channel":"EventCode=3, 22","data_component":"DC0082","data_component_name":"Network Connection Creation","log_source_slug":"wineventlog-sysmon"},{"name":"WinEventLog:PowerShell","channel":"EventCode=4103, 4104, 4105, 4106","data_component":"DC0029","data_component_name":"Script Execution","log_source_slug":"wineventlog-powershell"},{"name":"m365:defender","channel":"NetworkConnection: high out:in ratio, periodic beacons, protocol mismatch","data_component":"DC0078","data_component_name":"Network Traffic Flow","log_source_slug":"m365-defender"}],"mutable_elements":[{"field":"EntropyThreshold","description":"Minimum Shannon entropy for the suspected token/payload (e.g., >4.8)."},{"field":"TokenLengthThreshold","description":"Minimum continuous token length to treat as potential non-standard payload (e.g., ≥120 chars)."},{"field":"BytesOutToInRatio","description":"Out:In ratio considered suspicious (e.g., ≥4:1)."},{"field":"FixedPacketStdDevThreshold","description":"Std. dev. threshold (size or interval) to mark packets as 'uniform' (beacon-like)."},{"field":"TimeWindow","description":"Correlation window from encode routine to egress (default 10m)."},{"field":"KnownLegitEncoders","description":"Legitimate in-house/custom encoders to suppress."}],"live":true,"detection_strategies":["DET0326"],"techniques":["T1132.002"]},{"id":"AN0928","stix_id":"x-mitre-analytic--09125bb1-29eb-4d40-994a-2e1aa7bcd105","name":"Analytic 0928","description":"Shell scripts or binaries implement custom mapping tables (tr/sed/awk/golang/rust/python encode loops), or emit long high-entropy tokens that fail Base64/Hex validation → correlated with egress showing asymmetric flow, protocol-mismatch payloads, or DNS/HTTP bodies containing low-diversity-but-long custom alphabets.","url":"https://attack.mitre.org/detectionstrategies/DET0326#AN0928","platforms":["Linux"],"log_source_references":[{"name":"auditd:SYSCALL","channel":"execve of interpreters (python, perl), custom binaries, or shell utilities with long arguments containing non-standard tokens","data_component":"DC0032","data_component_name":"Process Creation","log_source_slug":"auditd-syscall"},{"name":"WinEventLog:Sysmon","channel":"EventCode=3, 22","data_component":"DC0082","data_component_name":"Network Connection Creation","log_source_slug":"wineventlog-sysmon"},{"name":"NSM:Flow","channel":"http: HTTP bodies/headers contain long tokens with non-standard alphabets or constant-size periodic POSTs","data_component":"DC0085","data_component_name":"Network Traffic Content","log_source_slug":"nsm-flow"}],"mutable_elements":[{"field":"EntropyThreshold","description":"Payload entropy minimum."},{"field":"TokenLengthThreshold","description":"Length threshold for suspect tokens."},{"field":"BytesOutToInRatio","description":"Asymmetry cutoff for flows."},{"field":"TimeWindow","description":"Correlation join window."},{"field":"KnownEncoders","description":"Legitimate internal tools/agents."}],"live":true,"detection_strategies":["DET0326"],"techniques":["T1132.002"]},{"id":"AN0929","stix_id":"x-mitre-analytic--bdc546bb-9d92-489e-8aa8-8de1bd08f320","name":"Analytic 0929","description":"EndpointSecurity/Unified Logs show processes generating custom alphabets or long high-entropy, non-standard tokens → network logs (PF/Zeek/EDR) show asymmetric beacons, protocol mismatches, or periodic fixed-size posts.","url":"https://attack.mitre.org/detectionstrategies/DET0326#AN0929","platforms":["macOS"],"log_source_references":[{"name":"macos:endpointsecurity","channel":"ES_EVENT_TYPE_NOTIFY_EXEC: arguments contain long, non-standard tokens / custom alphabets","data_component":"DC0032","data_component_name":"Process Creation","log_source_slug":"macos-endpointsecurity"},{"name":"PF:Logs","channel":"high out:in ratio or fixed-size periodic flows","data_component":"DC0078","data_component_name":"Network Traffic Flow","log_source_slug":"pf-logs"},{"name":"NSM:Flow","channel":"http: suspicious long tokens with custom alphabets in body/headers","data_component":"DC0085","data_component_name":"Network Traffic Content","log_source_slug":"nsm-flow"}],"mutable_elements":[{"field":"EntropyThreshold","description":"Payload entropy minimum."},{"field":"TokenLengthThreshold","description":"Minimum suspicious token length."},{"field":"BytesOutToInRatio","description":"Asymmetry threshold."},{"field":"TimeWindow","description":"Correlation window."},{"field":"AllowedSignedBinaries","description":"Signed binaries that legitimately implement custom encoders."}],"live":true,"detection_strategies":["DET0326"],"techniques":["T1132.002"]},{"id":"AN0930","stix_id":"x-mitre-analytic--e518b7e5-6e98-43f6-86c2-f45f684c650f","name":"Analytic 0930","description":"ESXi shell or scripts produce long, high-entropy tokens (non-standard alphabets) in shell.log/hostd, followed by outbound flows (NSX/Zeek) with asymmetric ratios or protocol mismatches to non-management endpoints.","url":"https://attack.mitre.org/detectionstrategies/DET0326#AN0930","platforms":["ESXi"],"log_source_references":[{"name":"esxi:shell","channel":"commands containing long non-standard tokens or custom lookup tables","data_component":"DC0032","data_component_name":"Process Creation","log_source_slug":"esxi-shell"},{"name":"esxi:hostd","channel":"unexpected script invocations producing long encoded strings","data_component":"DC0038","data_component_name":"Application Log Content","log_source_slug":"esxi-hostd"},{"name":"NSM:Flow","channel":"network_flow: bytes_out >> bytes_in, fixed packet sizes/intervals to non-approved CIDRs","data_component":"DC0078","data_component_name":"Network Traffic Flow","log_source_slug":"nsm-flow"},{"name":"NSM:Flow","channel":"http: HTTP bodies from ESXi host IPs containing long, non-standard tokens","data_component":"DC0085","data_component_name":"Network Traffic Content","log_source_slug":"nsm-flow"}],"mutable_elements":[{"field":"MgmtCIDRs","description":"CIDRs allowed for normal ESXi mgmt/backup."},{"field":"BytesOutToInRatio","description":"Asymmetry cutoff (e.g., ≥3)."},{"field":"TokenLengthThreshold","description":"Minimum token length."},{"field":"TimeWindow","description":"Correlation window."}],"live":true,"detection_strategies":["DET0326"],"techniques":["T1132.002"]}],"live":true,"version":"1.0","techniques":["T1132.002"]}],"sigma_rules":[],"kev_cves":[],"_built":"2026-08-24 19:45 UTC","_attack_version":"19.2","_sigma_commit":"da9bb07d642a2826e89702445d32c795209ec108"}