MITRE ATT&CKsub-technique

T1132.001 Standard Encoding

Published 2020-03-14 Modified 2026-09-03 Official page ↗
Domain
enterprise
Tactics
Command And Control
Platforms
ESXi, Linux, macOS, Windows
Version
1.1
Created
2020-03-14

Description

Adversaries may encode data with a standard data encoding system to make the content of command and control traffic more difficult to detect. Command and control (C2) information can be encoded using a standard data encoding system that adheres to existing protocol specifications. Common data encoding schemes include ASCII, Unicode, hexadecimal, Base64, and MIME. Some data encoding systems may also result in data compression, such as gzip.

Related

Subtechnique of · MITRE ATT&CK (1)

  • T1132 Data Encoding technique

Tactic · MITRE ATT&CK (1)

  • TA0011 Command and Control tactic

Referenced by MITRE ATT&CK · mitigates (1)

  • M1031 Network Intrusion Prevention mitigation

Referenced by MITRE ATT&CK · uses (131)

  • S9063 DEEPROOT software (malware)
  • S9067 TWOSTROKE software (malware)
  • S9052 MiniFast software (malware)
  • S9043 Mini Shai-Hulud software (malware)
  • S9037 RustyWater software (malware)
  • S9028 PHPsert software (malware)
  • S9015 BRICKSTORM software (malware)
  • S1240 RedLine Stealer software (malware)
  • G1045 Salt Typhoon group
  • S1202 LockBit 3.0 software (malware)
  • S1196 Troll Stealer software (malware)
  • S1198 Gomir software (malware)
  • G1044 APT42 group
  • S1193 TAMECAT software (malware)
  • S1190 Kapeka software (malware)
  • S1183 StrelaStealer software (malware)
  • C0044 Juicy Mix campaign
  • S1169 Mango software (malware)
  • S1166 Solar software (malware)
  • S1160 Latrodectus software (malware)
  • S1156 Manjusaka software (malware)
  • S1145 Pikabot software (malware)
  • S1141 LunarWeb software (malware)
  • S1138 Gootloader software (malware)
  • S1117 GLASSTOKEN software (malware)
  • S1116 WARPWIRE software (malware)
  • S1115 WIREFIRE software (malware)
  • S1110 SLIGHTPULSE software (malware)
  • S1112 STEADYPULSE software (malware)
  • S1108 PULSECHECK software (malware)
Show all 131 ›

Referenced by Compliance · mitigates (8)

  • CIS-13.8 Deploy a Network Intrusion Prevention Solution CIS Safeguard v8.1
  • NIST-AC-4 Information Flow Enforcement NIST 800-53 control
  • NIST-CA-7 Continuous Monitoring NIST 800-53 control
  • NIST-CM-2 Baseline Configuration NIST 800-53 control
  • NIST-CM-6 Configuration Settings NIST 800-53 control
  • NIST-SC-7 Boundary Protection NIST 800-53 control
  • NIST-SI-3 Malicious Code Protection NIST 800-53 control
  • NIST-SI-4 System Monitoring NIST 800-53 control

References