Home/ATT&CK Technique/Data Encoding
ATT&CK Technique

Data Encoding

T1132 · command-and-control

Adversaries may encode data to make the content of command and control traffic more difficult to detect. Command and control (C2) information can be encoded using a standard data encoding system. Use of data encoding may adhere to existing protocol specifications and includes use of ASCII, Unicode, Base64, MIME, or other binary-to-text and character encoding systems.

Some data encoding systems may also result in data compression, such as gzip.

ESXiLinuxmacOSWindows
◆

Actors Using This

14
russia_speaking_cybercrimeAkira
russia_speaking_cybercrimeALPHV / BlackCat
north_koreaAndariel
chinaAoqin Dragon
chinaAPT10
chinaAPT17
chinaAPT1
chinaAPT31
iranAPT33
iranOilRig
iranAPT35
north_koreaAPT37
north_koreaAPT38
iranAPT39
◈

Likely Attack Path

Techniques the same actors pair with this one distinctively - those showing up among actors who use this technique noticeably more than across all actors (lift > 1.15), grouped by kill-chain phase. The × is that lift multiplier; the shared-actor count is in the tooltip. A near-universal technique pairs with everything at baseline, so its list is short by design.
reconnaissance earlier
T1589.002 · Email Addresses ×2.45
resource-development earlier
T1583.008 · Malvertising ×2.56
initial-access earlier
T1456 · Drive-By Compromise ×2.56
execution earlier
T1059.008 · Network Device CLI ×2.56
persistence earlier
T1137.001 · Office Template Macros ×2.56T1137.006 · Add-ins ×2.56
privilege-escalation earlier
T1546.001 · Change Default File Association ×2.56T1546.011 · Application Shimming ×2.56
discovery earlier
T1426 · System Information Discovery ×2.56T1482 · Domain Trust Discovery ×2.47
collection earlier
T1560.002 · Archive via Library ×2.56
command-and-control same
T1437 · Application Layer Protocol ×2.56T1437.001 · Web Protocols ×2.56T1132.001 · Standard Encoding ×2.52
other same
T1564.003 · Hidden Window ×2.49
▣

Mitigations

1
MITRE ATT&CK mitigations - vendor-agnostic guidance for reducing exposure to this technique.
M1031Network Intrusion Prevention

Use intrusion detection signatures to block traffic at network boundaries.

◈

Detection Coverage

1/6 layers
Coverage across standard detection surfaces. Rows marked none have no rule of that type mapped. Some are real blind spots worth closing; others are simply not applicable to this technique (e.g. YARA matches malware files, not network behaviour).
Behavioral / log (Sigma) none
Analytics (MITRE CAR) none
Runtime / container (Falco) 1
File / malware (YARA) none
Network (Suricata/Snort) none
Vuln scan (Nuclei) none
◈

Falco Runtime Rules

1
Container / Linux runtime detections that fire on this technique.
INFODecoding Payload in Container
Detect any use of {base64} decoding in a container. Legitimate applications may decode encoded payloads. The template list known_decode_payload_containers can be used for simple tuning and customization, or you can adopt custom, more refined tuning. Less sophisticated adversaries may {base64}-decode their payloads not only to obfuscate them, but also to ensure that the payload remains intact when the application processes it. Note that injecting commands into an application's input often results in the application processing passed strings like "sh -c". In these cases, you may be lucky and the encoded blob will also be logged. Otherwise, all you will see is the {base64} decoding command, as the encoded blob was already interpreted by the shell.
view condition
spawned_process and container and base64_decoding and not container.image.repository in (known_decode_payload_containers)
▣

Comply & Defend

NIST 800-53AC-04, CA-07, CM-02, CM-06, SC-07, SI-03, SI-04
D3FEND11 defensive techniques
Intelligence Graph · click any node to traverse
CVETechnique ActorTool Family
drag to reposition · click any node to traverse · button top-right enlarges
External lookups - second-class, for what we don’t hold ourselves
MITRE ATT&CKAtomic Red Teamcar (MITRE)
Vulnerabilities
CISA KEV catalog
CWE weaknesses
CAPEC attack patterns
Package vulnerabilities
Threat intelligence
Threat actors
Tools & malware
ATT&CK techniques
IOCs
Detection & defense
Sigma rules
YARA rules
Atomic Red Team tests
D3FEND countermeasures
Compliance
NIST 800-53
ISO 27001:2022
SOC 2 TSC
PCI-DSS v4.0
CIS Controls v8.1
About
All capabilities
Live statistics
Data sources
Privacy policy
Terms of service
threatengine.sh  ·  Open-source threat intelligence platform  ·  100+ authoritative sources  ·  Every fact traces to its origin