T1132 · Data Encoding · MITRE ATT&CK

Data Encoding MITRE reference T1132

45th pctamong all ATT&CK techniques for number of groups

1 group has been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.

Velvet AntG1047 ↗

Sent commands to compromised F5 BIG-IP devices in an encoded format requiring a passkey before interpretation and execution.1

created 2025-03-141 reference

All 1 groups for this technique

Offense vs defense T1132

Compare defenses against adversary use. Eight counts, ranking this technique against the entire ATT&CK Enterprise matrix. Attack sits left, defense right.

Data Encoding detection strategy DET0108

MITRE names one behaviour worth catching for this technique and breaks it into 4 analytics, one per platform. Each carries the log sources it needs and the fields you tune per environment.

Detection Strategy for Data Encoding in C2 Channels

Enterprise

4 platforms

AN0302 · Windows

Atypical processes (e.g., powershell.exe, regsvr32.exe) encode large outbound traffic using Base64 or other character encodings; this traffic is sent over uncommon ports or embedded in protocol fields (e.g., HTTP cookies or headers).

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Process CreationDC0032	WinEventLog:Sysmon	EventCode=1
Network Connection CreationDC0082	WinEventLog:Sysmon	EventCode=3, 22
Network Traffic ContentDC0085	NSM:Flow	Unusual Base64-encoded content in URI, headers, or POST body

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
PayloadEntropyThreshold	Adjust to accommodate legitimate compression or encryption patterns in normal web traffic
ProcessAllowlist	Define expected processes initiating outbound traffic to reduce false positives
AnomalyScoreThreshold	Set threshold for how far traffic deviates from baseline protocol structure or size

AN0303 · Linux

Custom scripts or processes encode outbound traffic using gzip, Base64, or hex prior to exfiltration via curl, wget, or custom sockets. Encoding typically occurs before or during outbound connections from non-network daemons.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Process CreationDC0032	auditd:SYSCALL	execve
Command ExecutionDC0064	linux:syslog	Unusual outbound transfers from CLI tools like base64, gzip, or netcat
Network Traffic ContentDC0085	NSM:Flow	Base64 strings or gzip in URI, headers, or POST body

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
TimeWindow	Tune duration of multi-stage encoding + transfer operations to account for script variability
UserContext	Apply user allow/block list depending on which users normally perform CLI encoding

AN0304 · macOS

Processes use built-in encoding utilities (e.g., base64, xxd, or plutil) to encode file contents followed by HTTP/HTTPS transfer via curl or custom applications.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Command ExecutionDC0064	macos:unifiedlog	base64 or curl processes chained within short execution window
Network Traffic ContentDC0085	macos:unifiedlog	HTTP POST with encoded content in user-agent or cookie field

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
EncodedCommandLengthThreshold	Minimum byte size of encoded strings to treat as suspicious
SuspiciousProcessChainDepth	Number of chained processes within a short window to treat as a correlated behavior

AN0305 · ESXi

ESXi daemons (e.g., hostd, vpxa) are wrapped or impersonated to send large outbound traffic using gzip/Base64 encoding over SSH or HTTP. These actions follow suspicious logins or shell access.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
User Account AuthenticationDC0002	ESXiLogs:authlog	Unexpected login followed by encoding commands
Command ExecutionDC0064	esxi:shell	base64 or gzip use within shell session
Network Traffic ContentDC0085	esxi:vmkernel	Outbound traffic using encoded payloads post-login

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
AuthSourceTrustLevel	Use to scope encoded traffic suspicion to accounts that should not initiate transfers
ExfilBurstThreshold	Threshold for bursty outbound traffic size deviation from baseline

Data Encoding detections T1132

No detection rules are mapped to this technique yet.

None recorded— 32% of ATT&CK techniques have none either

No matching rules

Drag headers to reorder | Drag edges to resize

Select	Title	Description	Category	Status	Event	OS	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID	Refs
No rules found. Try adjusting your filters.

Data Encoding T1132

Data Encoding T1132

Data Encoding MITRE reference T1132

Offense vs defense T1132

Data Encoding detection strategy DET0108

Detection Strategy for Data Encoding in C2 Channels

Log sources

Tunable fields

Log sources

Tunable fields

Log sources

Tunable fields

Log sources

Tunable fields

Data Encoding MITRE reference T1132

Offense vs defense T1132

Data Encoding detection strategy DET0108

Detection Strategy for Data Encoding in C2 Channels

Log sources

Tunable fields

Log sources

Tunable fields

Log sources

Tunable fields

Log sources

Tunable fields

Data Encoding detections T1132

Data Encoding detections T1132