Techniques › T1132
T1132 Data Encoding
command and control — ESXi, Linux, macOS, Windows · attack.mitre.org · JSON
1
MITRE detection strategy
4
analytics
0
Sigma rules tagged attack.t1132
0
KEV CVEs mapped here
<p>Adversaries may encode data to make the content of command and control traffic more difficult to detect. Command and control (C2) information can be encoded using a standard data encoding system. Use of data encoding may adhere to existing protocol specifications and includes use of ASCII, Unicode, Base64, MIME, or other binary-to-text and character encoding systems. Some data encoding systems may also result in data compression, such as gzip.</p>
KEV CVEs mapped to this technique · CTID Mappings Explorer
None. No KEV entry in the public mapping names this technique. Given that 74.7% of KEV has no mapping at all, this says more about the mapping than about the technique.
Detection strategy · ATT&CK Enterprise v19.2
- DET0108 Detection Strategy for Data Encoding in C2 Channels v1.0
AN0302 WindowsAtypical processes (e.g., powershell.exe, regsvr32.exe) encode large outbound traffic using Base64 or other character encodings; this traffic is sent over uncommon ports or embedded in protocol fields (e.g., HTTP cookies or headers).NSM:Flow
Unusual Base64-encoded content in URI, headers, or POST body→ DC0085 Network Traffic ContentTunable:PayloadEntropyThresholdProcessAllowlistAnomalyScoreThresholdAN0303 LinuxCustom scripts or processes encode outbound traffic using gzip, Base64, or hex prior to exfiltration via curl, wget, or custom sockets. Encoding typically occurs before or during outbound connections from non-network daemons.linux:syslogUnusual outbound transfers from CLI tools like base64, gzip, or netcat→ DC0064 Command ExecutionTunable:TimeWindowUserContextAN0304 macOSProcesses use built-in encoding utilities (e.g.,base64,xxd, orplutil) to encode file contents followed by HTTP/HTTPS transfer via curl or custom applications.macos:unifiedlogbase64 or curl processes chained within short execution window→ DC0064 Command Executionmacos:unifiedlogHTTP POST with encoded content in user-agent or cookie field→ DC0085 Network Traffic ContentTunable:EncodedCommandLengthThresholdSuspiciousProcessChainDepthAN0305 ESXiESXi daemons (e.g., hostd, vpxa) are wrapped or impersonated to send large outbound traffic using gzip/Base64 encoding over SSH or HTTP. These actions follow suspicious logins or shell access.ESXiLogs:authlogUnexpected login followed by encoding commands→ DC0002 User Account AuthenticationTunable:AuthSourceTrustLevelExfilBurstThreshold
Sigma rules · SigmaHQ da9bb07d64, tag attack.t1132
No Sigma rule carries this tag. MITRE publishes a detection strategy above, so the behaviour is specified; what is missing is public detection content.