{"id":"T1132.001","name":"Standard Encoding","url":"https://attack.mitre.org/techniques/T1132/001","tactics":["command-and-control"],"platforms":["ESXi","Linux","macOS","Windows"],"live":true,"revoked":false,"deprecated":false,"revoked_by":null,"detection_strategies":[{"id":"DET0124","stix_id":"x-mitre-detection-strategy--1f6a450a-fd29-4e5c-9708-1ae4616c28c3","name":"Behavior-chain detection for T1132.001 Data Encoding: Standard Encoding (Base64/Hex/MIME) across Windows, Linux, macOS, ESXi","url":"https://attack.mitre.org/detectionstrategies/DET0124","analytics":[{"id":"AN0345","stix_id":"x-mitre-analytic--861ee805-c979-44c9-8b0c-86bd3a6f5872","name":"Analytic 0345","description":"Process invokes a standard encoder (e.g., PowerShell -enc, certutil -encode, base64 via .NET/Invoke-Expression) or emits long Base64/hex literals → shortly followed by outbound network egress with high bytes_out:bytes_in ratio or HTTP headers/payloads containing Base64/MIME blocks.","url":"https://attack.mitre.org/detectionstrategies/DET0124#AN0345","platforms":["Windows"],"log_source_references":[{"name":"WinEventLog:Security","channel":"EventCode=4688","data_component":"DC0032","data_component_name":"Process Creation","log_source_slug":"wineventlog-security"},{"name":"WinEventLog:Sysmon","channel":"EventCode=3, 22","data_component":"DC0082","data_component_name":"Network Connection Creation","log_source_slug":"wineventlog-sysmon"},{"name":"WinEventLog:PowerShell","channel":"EventCode=4103, 4104, 4105, 4106","data_component":"DC0029","data_component_name":"Script Execution","log_source_slug":"wineventlog-powershell"},{"name":"M365Defender:DeviceNetworkEvents","channel":"NetworkConnection: bytes_sent >> bytes_received anomaly","data_component":"DC0078","data_component_name":"Network Traffic Flow","log_source_slug":"m365defender-devicenetworkevents"}],"mutable_elements":[{"field":"PayloadEntropyThreshold","description":"Shannon entropy cutoff to consider payload suspicious (e.g., > 4.5–5.0 for HTTP body)."},{"field":"B64LengthThreshold","description":"Min continuous Base64 token length in command lines/script blocks to alert (e.g., > 100 chars)."},{"field":"TimeWindow","description":"Correlation window between encoding event and egress (default 10m)."},{"field":"KnownAdminTools","description":"Legitimate tools (e.g., backup agents) that routinely encode/compress data."},{"field":"BytesOutToInRatio","description":"Minimum ratio to treat flow as asymmetric (e.g., ≥ 4:1)."}],"live":true,"detection_strategies":["DET0124"],"techniques":["T1132.001"]},{"id":"AN0346","stix_id":"x-mitre-analytic--904100f0-1af9-4ded-89be-dfda7180bcbc","name":"Analytic 0346","description":"Shell/utility (base64, xxd -p, od, openssl enc -base64, python/perl base64 libraries) encodes data → subsequent outbound connections (curl/wget/bash TCP, socat, python requests) with high asymmetry or Base64/MIME blobs in HTTP/DNS payloads.","url":"https://attack.mitre.org/detectionstrategies/DET0124#AN0346","platforms":["Linux"],"log_source_references":[{"name":"auditd:SYSCALL","channel":"execve of base64|openssl|xxd|python|perl with arguments matching Base64 flags","data_component":"DC0032","data_component_name":"Process Creation","log_source_slug":"auditd-syscall"},{"name":"WinEventLog:Sysmon","channel":"EventCode=3, 22","data_component":"DC0082","data_component_name":"Network Connection Creation","log_source_slug":"wineventlog-sysmon"},{"name":"NSM:Flow","channel":"http: HTTP body or headers contain long Base64 sections; gzip/deflate + Base64","data_component":"DC0085","data_component_name":"Network Traffic Content","log_source_slug":"nsm-flow"}],"mutable_elements":[{"field":"EncodingToolsAllowList","description":"Build/backup jobs that legitimately call base64/openssl."},{"field":"EntropyThreshold","description":"Shannon entropy for payloads (e.g., >4.5)."},{"field":"TimeWindow","description":"Join window between exec and egress (default 10m)."},{"field":"OutInRatio","description":"Bytes_out / bytes_in threshold (default 4)."}],"live":true,"detection_strategies":["DET0124"],"techniques":["T1132.001"]},{"id":"AN0347","stix_id":"x-mitre-analytic--5eefb166-8f2b-45e0-b5c8-bf71984dec08","name":"Analytic 0347","description":"Processes use base64/xxd/openssl/python Objective‑C APIs to encode data (seen in EndpointSecurity exec events or Unified Logs) → quick outbound connections with large bytes_out or HTTP POSTs carrying Base64/MIME bodies.","url":"https://attack.mitre.org/detectionstrategies/DET0124#AN0347","platforms":["macOS"],"log_source_references":[{"name":"macos:unifiedlog","channel":"process command line contains base64, -enc, openssl enc -base64","data_component":"DC0032","data_component_name":"Process Creation","log_source_slug":"macos-unifiedlog"},{"name":"PF:Logs","channel":"outbound flows with bytes_out >> bytes_in","data_component":"DC0078","data_component_name":"Network Traffic Flow","log_source_slug":"pf-logs"},{"name":"NSM:Flow","channel":"http: HTTP body contains long Base64 sections","data_component":"DC0085","data_component_name":"Network Traffic Content","log_source_slug":"nsm-flow"}],"mutable_elements":[{"field":"AllowedDeveloperIDs","description":"Signed/allowed developer binaries routinely using encoding."},{"field":"EntropyThreshold","description":"Payload entropy cutoff."},{"field":"TimeWindow","description":"Exec → egress window."}],"live":true,"detection_strategies":["DET0124"],"techniques":["T1132.001"]},{"id":"AN0348","stix_id":"x-mitre-analytic--1b53dd1b-c98e-4b25-a7fd-70dad586ebf1","name":"Analytic 0348","description":"ESXi shell (BusyBox) or VMware utilities (openssl, python if present) used to Base64/hex encode data from datastore or config files → followed by abnormal egress from the host (NSX/flow logs) with asymmetric bytes_out or HTTPS posts to non-management endpoints.","url":"https://attack.mitre.org/detectionstrategies/DET0124#AN0348","platforms":["ESXi"],"log_source_references":[{"name":"esxi:shell","channel":"commands containing base64, openssl enc -base64, xxd -p","data_component":"DC0032","data_component_name":"Process Creation","log_source_slug":"esxi-shell"},{"name":"esxi:hostd","channel":"unexpected script/command invocations via hostd","data_component":"DC0038","data_component_name":"Application Log Content","log_source_slug":"esxi-hostd"},{"name":"NSX:FlowLogs","channel":"network_flow: bytes_out >> bytes_in to external","data_component":"DC0078","data_component_name":"Network Traffic Flow","log_source_slug":"nsx-flowlogs"},{"name":"NSM:Flow","channel":"http: Base64/MIME looking payloads from ESXi host IP","data_component":"DC0085","data_component_name":"Network Traffic Content","log_source_slug":"nsm-flow"}],"mutable_elements":[{"field":"MgmtCIDRs","description":"CIDRs for legitimate vCenter/NSX/backup endpoints."},{"field":"BytesRatio","description":"Out:In ratio deemed suspicious (e.g., ≥3 on ESXi)."},{"field":"TimeWindow","description":"Correlation window between shell command and egress."}],"live":true,"detection_strategies":["DET0124"],"techniques":["T1132.001"]}],"live":true,"version":"1.0","techniques":["T1132.001"]}],"sigma_rules":[{"id":"98767d61-b2e8-4d71-b661-e36783ee24c1","title":"Gzip Archive Decode Via PowerShell","author":"Hieu Tran","status":"test","level":"medium","date":"2023-03-13","modified":null,"description":"Detects attempts of decoding encoded Gzip archives via PowerShell.","references":["https://www.zscaler.com/blogs/security-research/onenote-growing-threat-malware-distribution"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.command-and-control","attack.t1132.001"],"path":"rules/windows/process_creation/proc_creation_win_powershell_decode_gzip.yml","techniques":["T1132.001"],"cves":[]},{"id":"98a96a5a-64a0-4c42-92c5-489da3866cb0","title":"DNS Exfiltration and Tunneling Tools Execution","author":"Daniil Yugoslavskiy, oscd.community","status":"test","level":"high","date":"2019-10-24","modified":"2021-11-27","description":"Well-known DNS Exfiltration tools execution","references":["https://github.com/iagox86/dnscat2","https://github.com/yarrick/iodine"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.exfiltration","attack.t1048.001","attack.command-and-control","attack.t1071.004","attack.t1132.001"],"path":"rules/windows/process_creation/proc_creation_win_dns_exfiltration_tools_execution.yml","techniques":["T1048.001","T1071.004","T1132.001"],"cves":[]},{"id":"d75d6b6b-adb9-48f7-824b-ac2e786efe1f","title":"Suspicious FromBase64String Usage On Gzip Archive - Process Creation","author":"frack113","status":"test","level":"medium","date":"2022-12-23","modified":null,"description":"Detects attempts of decoding a base64 Gzip archive via PowerShell. This technique is often used as a method to load malicious content into memory afterward.","references":["https://speakerdeck.com/heirhabarov/hunting-for-powershell-abuse?slide=43"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.command-and-control","attack.t1132.001"],"path":"rules/windows/process_creation/proc_creation_win_powershell_frombase64string_archive.yml","techniques":["T1132.001"],"cves":[]},{"id":"df69cb1d-b891-4cd9-90c7-d617d90100ce","title":"Suspicious FromBase64String Usage On Gzip Archive - Ps Script","author":"frack113","status":"test","level":"medium","date":"2022-12-23","modified":null,"description":"Detects attempts of decoding a base64 Gzip archive in a PowerShell script. This technique is often used as a method to load malicious content into memory afterward.","references":["https://speakerdeck.com/heirhabarov/hunting-for-powershell-abuse?slide=43"],"logsource":{"product":"windows","category":"ps_script"},"tags":["attack.command-and-control","attack.t1132.001"],"path":"rules/windows/powershell/powershell_script/posh_ps_frombase64string_archive.yml","techniques":["T1132.001"],"cves":[]}],"kev_cves":[],"_built":"2026-08-23 05:47 UTC","_attack_version":"19.2","_sigma_commit":"da9bb07d642a2826e89702445d32c795209ec108"}