Velvet AntG1047 ↗
Sent commands to compromised F5 BIG-IP devices in an encoded format requiring a passkey before interpretation and execution.1
tfMITRE ATT&CK technique
Data Encoding T1132
- Tactic
- Command and Control
- Platforms
- ESXi, Linux, macOS, Windows
- Version
- 1.3
- Created
- 31 May 2017
- Last modified
- 12 May 2026
- Contributor
- Itzik Kotler, SafeBreach
Sub-techniques 24 rules across the family · 0 mapped directly to T1132 · 1 of 2 carry rules
Adversaries may encode data to make the content of command and control traffic more difficult to detect. Command and control (C2) information can be encoded using a standard data encoding system. Use of data encoding may adhere to existing protocol specifications and includes use of ASCII, Unicode, Base64, MIME, or other binary-to-text and character encoding systems.[1] [2] Some data encoding systems may also result in data compression, such as gzip.
ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact
1
Threat groups45th pct
Threat groups45th percentile · 55% of ATT&CK techniques have more threat groups attributed.0
CampaignsNone recorded
CampaignsNone recorded · 54% of ATT&CK techniques have none either.7
Tools & malware71st pct
Tools & malware71st percentile · 71% of ATT&CK techniques have this many tools implementing them or fewer.0
Detection rulesNone recorded
Detection rulesNone recorded · 33% of ATT&CK techniques have none either.Data Encoding MITRE reference T1132
45th pctamong all ATT&CK techniques for number of groups
1 group has been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.
All 1 groups for this technique
7 software entries are documented implementing this technique. MITRE files each as a tool or as malware; newest first, then by how many groups carry them.
LAMEHUGS9035 ↗
Can encode queries sent to LLMs.1
evilginx2S9003 ↗
Can randomly generate and Base64 encode parameters in phishing links to defeat static detection.1
MythicS0699 ↗
Provides various transform functions to encode and/or randomize C2 data.1
UrsnifS0386 ↗
Has used encoded data in HTTP URLs for C2.1
Linux RabbitS0362 ↗
Sends the payload from the C2 server as an encoded URL parameter. 1
H1N1S0132 ↗
Obfuscates C2 traffic with an altered version of base64.1
All 7 software entries for this technique · 6 newest in this preview
Offense vs defense T1132
Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.
Data Encoding detection strategy DET0108
MITRE names one behaviour worth catching for this technique and breaks it into 4 analytics, one per platform. Each carries the log sources it needs and the fields you tune per environment.
Detection Strategy for Data Encoding in C2 Channels
4 platforms
AN0302 · Windows
Atypical processes (e.g., powershell.exe, regsvr32.exe) encode large outbound traffic using Base64 or other character encodings; this traffic is sent over uncommon ports or embedded in protocol fields (e.g., HTTP cookies or headers).
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Process CreationDC0032 | WinEventLog:Sysmon | EventCode=1 |
| Network Connection CreationDC0082 | WinEventLog:Sysmon | EventCode=3, 22 |
| Network Traffic ContentDC0085 | NSM:Flow | Unusual Base64-encoded content in URI, headers, or POST body |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| PayloadEntropyThreshold | Adjust to accommodate legitimate compression or encryption patterns in normal web traffic |
| ProcessAllowlist | Define expected processes initiating outbound traffic to reduce false positives |
| AnomalyScoreThreshold | Set threshold for how far traffic deviates from baseline protocol structure or size |
AN0303 · Linux
Custom scripts or processes encode outbound traffic using gzip, Base64, or hex prior to exfiltration via curl, wget, or custom sockets. Encoding typically occurs before or during outbound connections from non-network daemons.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Process CreationDC0032 | auditd:SYSCALL | execve |
| Command ExecutionDC0064 | linux:syslog | Unusual outbound transfers from CLI tools like base64, gzip, or netcat |
| Network Traffic ContentDC0085 | NSM:Flow | Base64 strings or gzip in URI, headers, or POST body |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| TimeWindow | Tune duration of multi-stage encoding + transfer operations to account for script variability |
| UserContext | Apply user allow/block list depending on which users normally perform CLI encoding |
AN0304 · macOS
Processes use built-in encoding utilities (e.g., base64, xxd, or plutil) to encode file contents followed by HTTP/HTTPS transfer via curl or custom applications.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Command ExecutionDC0064 | macos:unifiedlog | base64 or curl processes chained within short execution window |
| Network Traffic ContentDC0085 | macos:unifiedlog | HTTP POST with encoded content in user-agent or cookie field |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| EncodedCommandLengthThreshold | Minimum byte size of encoded strings to treat as suspicious |
| SuspiciousProcessChainDepth | Number of chained processes within a short window to treat as a correlated behavior |
AN0305 · ESXi
ESXi daemons (e.g., hostd, vpxa) are wrapped or impersonated to send large outbound traffic using gzip/Base64 encoding over SSH or HTTP. These actions follow suspicious logins or shell access.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| User Account AuthenticationDC0002 | ESXiLogs:authlog | Unexpected login followed by encoding commands |
| Command ExecutionDC0064 | esxi:shell | base64 or gzip use within shell session |
| Network Traffic ContentDC0085 | esxi:vmkernel | Outbound traffic using encoded payloads post-login |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| AuthSourceTrustLevel | Use to scope encoded traffic suspicion to accounts that should not initiate transfers |
| ExfilBurstThreshold | Threshold for bursty outbound traffic size deviation from baseline |
Network intrusion detection and prevention systems that use network signatures to identify traffic for specific adversary malware can be used to mitigate activity at the network level. Signatures are often for unique indicators within protocols and may be based on the specific obfuscation technique used by a particular adversary or tool, and will likely be different across various malware families and versions. Adversaries will likely change tool C2 signatures over time or construct protocols in such a way as to avoid detection by common defensive tools.