AN0345 Analytic 0345

Windows · attack.mitre.org · ATT&CK Enterprise v19.2

<p>Process invokes a standard encoder (e.g., PowerShell -enc, certutil -encode, base64 via .NET/Invoke-Expression) or emits long Base64/hex literals → shortly followed by outbound network egress with high bytes_out:bytes_in ratio or HTTP headers/payloads containing Base64/MIME blocks.</p>

Detects: T1132.001 Standard Encoding
Part of: DET0124 Behavior-chain detection for T1132.001 Data Encoding: Standard Encoding (Base64/Hex/MIME) across Windows, Linux, macOS, ESXi

Log sources and channels

Exactly as MITRE states them in x_mitre_log_source_references. Where a channel is vague, it is vague in the source; kevmap does not tidy it.

Log source	Channel	Data component
WinEventLog:Security	`EventCode=4688`	DC0032 Process Creation
WinEventLog:Sysmon	`EventCode=3, 22`	DC0082 Network Connection Creation
WinEventLog:PowerShell	`EventCode=4103, 4104, 4105, 4106`	DC0029 Script Execution
M365Defender:DeviceNetworkEvents	`NetworkConnection: bytes_sent >> bytes_received anomaly`	DC0078 Network Traffic Flow

Mutable elements

Parameters MITRE marks as environment-specific. These are the knobs you are expected to tune; they are why an analytic is not a rule.

Field	Description
`PayloadEntropyThreshold`	Shannon entropy cutoff to consider payload suspicious (e.g., > 4.5–5.0 for HTTP body).
`B64LengthThreshold`	Min continuous Base64 token length in command lines/script blocks to alert (e.g., > 100 chars).
`TimeWindow`	Correlation window between encoding event and egress (default 10m).
`KnownAdminTools`	Legitimate tools (e.g., backup agents) that routinely encode/compress data.
`BytesOutToInRatio`	Minimum ratio to treat flow as asymmetric (e.g., ≥ 4:1).