FORENSIA

ATT&CK · T1132

Data Encoding

Tactics: command-and-control

About

Adversaries may encode data to make the content of command and control traffic more difficult to detect. Command and control (C2) information can be encoded using a standard data encoding system. Use of data encoding may adhere to existing protocol specifications and includes use of ASCII, Unicode, Base64, MIME, or other binary-to-text and character encoding systems. Some data encoding systems may also result in data compression, such as gzip.

Platforms: ESXi, Linux, macOS, WindowsMITRE ATT&CK ↗

Used by actors

1 known groups

Software

7 malware/tools implement this

BADNEWSH1N1Linux RabbitUrsnifMythicevilginx2LAMEHUG

Corpus indicators tagged with this technique

110 indicators in the corpus carry T1132.

IndicatorTypeFamilySevSrc
b270bdf8e2274ea1af0a6eed74d8f10e5fe61012d6cc226a43cc7cc7fd9f6292sha256supply_chain802
082d733db0687dcd768104972b065d4b58cb1e6043688c6c20fa3702337f36absha256supply_chain803
5d2ad1795b0dfc4a58424b2fa2f002246f653b119d362954ae270b6998e9d575hashphishing803
375c2c84e2ca022c565507523b75c9c08a455479861ea41fc9b9ff74b3453445hashphishing803
c5ec55270af084d3c07d2918098d598bc2c5ca42f4189d69cdfcae2c958e5ec7hashphishing803
9b2e65db653ca8575c9b10eefb9a80c6006404812c2ec212bf5675e3c690233bsha256supply_chain803
550af477c12192a22f5c9edb9c8081c0a789b3a1a2992a7ecb157cca1c975e10sha256supply_chain801
9f1a709310824f9110c6203d861a721ebefba8b204a8657057fe57efb961c850sha256supply_chain801
a08d8e63b0cd3638fb40b8e6da546e26da69439597565827f9cec87915f78568sha256ransomware801
13ac78f8f2ed76a03c85f0cdef07e5463aa64458303c0949090fcd81868ba8cahashphishing803
b9993a8ad0518849416798cf29668256ccb96598fc4423501ccab5312812653asha256supply_chain802
7fda5f10a2bc212daaa467484c56eb8abf3f3681f6405c5c2fac16d4124e44cahashphishing803
34014776d3d3ff11bc4439b02fd7ac0f02a887eb3a052eeafff236e2f6db8ad1sha256supply_chain803
d425e4583cc6185d41e95c45eda00550045a5d1919b9a012236a4520d009dbd7sha256supply_chain803
3d1158884fb339b3328bd330fcc27598e1f1c94bcac39e75d1a272afa4deee1asha256ransomware801
d6b6eb84b0718cbd02eea586637679b4d77bb34fhash803
9e214f38537e69bf51c7fa1ddd35ae495e9cb897231ec010baf9e4f29407ee9asha256supply_chain801
1962cef10cf737300d04a23139122abcc8e8803e54dfcb63054140fbe549bed0hash802
6506d31707a39949f89534bf9705bcf889f1ecae3dbc6f4ff88d67a8be3d01b2hashsupply_chain802
6d332f814f15f19758d65026bbfd0a8c49671b319ec77b8fa1b27fc48afff7d9hashsupply_chain802
95fc58dc321b07ecc99d95359bcdee08a5beb519ead8e70e40f33928533a1b14hashphishing803
f48bf08687948ead049686cdee0e92ddhash803
8c4f8abe69bde5e1a53ca98fe22e13aahash803
6e78713b75bd34828d49896176627f7face7aa9036cd874f2e02d9f23a9a9c71sha256supply_chain802
bfaeb987faa6de2b5a5eb63b1233d055215b09b0349a9394f2175fd7cdf385e4sha256supply_chain803
6c428acbd91be85fedf9cbb334457ddea08ff624d4de88041749578e968d62a8hashphishing803
606966a9ec33765baedf63331595d1168f2a596fhash803
f0ea4c47bc8fec96770d023f1025bcb3hash803
a3d2ea3aa5850ecac5e75b0cc1467bda57dbb776hash803
24b9ee242f21a73b55f7bb3297eafb33c60840907386b542ed79fc6b72365168sha256supply_chain802

Showing the top 30 by severity of 110.