Techniques › T1132 › T1132.001
T1132.001 Standard Encoding
command and control — ESXi, Linux, macOS, Windows · attack.mitre.org · JSON
1
MITRE detection strategy
4
analytics
4
Sigma rules tagged attack.t1132.001
0
KEV CVEs mapped here
<p>Adversaries may encode data with a standard data encoding system to make the content of command and control traffic more difficult to detect. Command and control (C2) information can be encoded using a standard data encoding system that adheres to existing protocol specifications. Common data encoding schemes include ASCII, Unicode, hexadecimal, Base64, and MIME. Some data encoding systems may also result in data compression, such as gzip.</p>
KEV CVEs mapped to this technique · CTID Mappings Explorer
None. No KEV entry in the public mapping names this technique. Given that 74.7% of KEV has no mapping at all, this says more about the mapping than about the technique.
Detection strategy · ATT&CK Enterprise v19.2
- DET0124 Behavior-chain detection for T1132.001 Data Encoding: Standard Encoding (Base64/Hex/MIME) across Windows, Linux, macOS, ESXi v1.0
AN0345 WindowsProcess invokes a standard encoder (e.g., PowerShell -enc, certutil -encode, base64 via .NET/Invoke-Expression) or emits long Base64/hex literals → shortly followed by outbound network egress with high bytes_out:bytes_in ratio or HTTP headers/payloads containing Base64/MIME blocks.M365Defender:DeviceNetworkEvents
NetworkConnection: bytes_sent >> bytes_received anomaly→ DC0078 Network Traffic FlowTunable:PayloadEntropyThresholdB64LengthThresholdTimeWindowKnownAdminToolsBytesOutToInRatioAN0346 LinuxShell/utility (base64, xxd -p, od, openssl enc -base64, python/perl base64 libraries) encodes data → subsequent outbound connections (curl/wget/bash TCP, socat, python requests) with high asymmetry or Base64/MIME blobs in HTTP/DNS payloads.auditd:SYSCALLexecve of base64|openssl|xxd|python|perl with arguments matching Base64 flags→ DC0032 Process CreationNSM:Flowhttp: HTTP body or headers contain long Base64 sections; gzip/deflate + Base64→ DC0085 Network Traffic ContentTunable:EncodingToolsAllowListEntropyThresholdTimeWindowOutInRatioAN0347 macOSProcesses use base64/xxd/openssl/python Objective‑C APIs to encode data (seen in EndpointSecurity exec events or Unified Logs) → quick outbound connections with large bytes_out or HTTP POSTs carrying Base64/MIME bodies.macos:unifiedlogprocess command line contains base64, -enc, openssl enc -base64→ DC0032 Process CreationTunable:AllowedDeveloperIDsEntropyThresholdTimeWindowAN0348 ESXiESXi shell (BusyBox) or VMware utilities (openssl, python if present) used to Base64/hex encode data from datastore or config files → followed by abnormal egress from the host (NSX/flow logs) with asymmetric bytes_out or HTTPS posts to non-management endpoints.Tunable:MgmtCIDRsBytesRatioTimeWindow
Sigma rules · SigmaHQ da9bb07d64, tag attack.t1132.001
Author: Hieu Tran
· 2023-03-13 · logsource: product=windows category=process_creation · 98767d61-b2e8-4d71-b661-e36783ee24c1
Detects attempts of decoding encoded Gzip archives via PowerShell.
Author: Daniil Yugoslavskiy, oscd.community
· 2019-10-24 (modified 2021-11-27) · logsource: product=windows category=process_creation · 98a96a5a-64a0-4c42-92c5-489da3866cb0
Well-known DNS Exfiltration tools execution
Author: frack113
· 2022-12-23 · logsource: product=windows category=process_creation · d75d6b6b-adb9-48f7-824b-ac2e786efe1f
Detects attempts of decoding a base64 Gzip archive via PowerShell. This technique is often used as a method to load malicious content into memory afterward.
Author: frack113
· 2022-12-23 · logsource: product=windows category=ps_script · df69cb1d-b891-4cd9-90c7-d617d90100ce
Detects attempts of decoding a base64 Gzip archive in a PowerShell script. This technique is often used as a method to load malicious content into memory afterward.