Technique with 2 sub-techniques.View on attack.mitre.org
Adversaries may encode data to make the content of command and control traffic more difficult to detect. Command and control (C2) information can be encoded using a standard data encoding system. Use of data encoding may adhere to existing protocol specifications and includes use of ASCII, Unicode, Base64, MIME, or other binary-to-text and character encoding systems. Some data encoding systems may also result in data compression, such as gzip.
Rules on DetectionCode tagged with T1132 or one of its sub-techniques.
| Rule | Level | Log source | Technique |
|---|---|---|---|
| DNS Exfiltration and Tunneling Tools Execution | high | windows / process_creation | T1132.001 |
| Gzip Archive Decode Via PowerShell | medium | windows / process_creation | T1132.001 |
| Suspicious FromBase64String Usage On Gzip Archive - Process Creation | medium | windows / process_creation | T1132.001 |
| Suspicious FromBase64String Usage On Gzip Archive - Ps Script | medium | windows / ps_script | T1132.001 |
None recorded.
| Used by | Procedure example |
|---|---|
| GroupVelvet Ant | Velvet Ant sent commands to compromised F5 BIG-IP devices in an encoded format requiring a passkey before interpretation and execution. |
| Used by | Procedure example |
|---|---|
| MalwareBADNEWS | After encrypting C2 data, BADNEWS converts it into a hexadecimal representation and then encodes it into base64. |
| Toolevilginx2 | evilginx2 can randomly generate and Base64 encode parameters in phishing links to defeat static detection. |
| MalwareH1N1 | H1N1 obfuscates C2 traffic with an altered version of base64. |
| MalwareLAMEHUG | LAMEHUG can encode queries sent to LLMs. |
| MalwareLinux Rabbit | Linux Rabbit sends the payload from the C2 server as an encoded URL parameter. |
| ToolMythic | Mythic provides various transform functions to encode and/or randomize C2 data. |
| MalwareUrsnif | Ursnif has used encoded data in HTTP URLs for C2. |
Data from MITRE ATT&CK® (Enterprise). ATT&CK® is a registered trademark of The MITRE Corporation.
