MITRE ATT&CKsub-technique

T1132.002 Non-Standard Encoding

Published 2020-03-14 Modified 2026-05-12 Official page ↗
Domain
enterprise
Tactics
Command And Control
Platforms
ESXi, Linux, macOS, Windows
Version
1.1
Created
2020-03-14

Description

Adversaries may encode data with a non-standard data encoding system to make the content of command and control traffic more difficult to detect. Command and control (C2) information can be encoded using a non-standard data encoding system that diverges from existing protocol specifications. Non-standard data encoding schemes may be based on or related to standard data encoding schemes, such as a modified Base64 encoding for the message body of an HTTP request.

Related

Subtechnique of · MITRE ATT&CK (1)

  • T1132 Data Encoding technique

Tactic · MITRE ATT&CK (1)

  • TA0011 Command and Control tactic

Referenced by MITRE ATT&CK · mitigates (1)

  • M1031 Network Intrusion Prevention mitigation

Referenced by MITRE ATT&CK · uses (18)

  • S9007 HTTPTroy software (malware)
  • S1239 TONESHELL software (malware)
  • S1189 Neo-reGeorg software (malware)
  • S1149 CHIMNEYSWEEP software (malware)
  • S1100 Ninja software (malware)
  • S1090 NightClub software (malware)
  • S1046 PowGoop software (malware)
  • S1035 Small Sieve software (malware)
  • S0687 Cyclops Blink software (malware)
  • S0681 Lizar software (malware)
  • S0596 ShadowPad software (malware)
  • S0495 RDAT software (malware)
  • G0094 Kimsuky group
  • S0346 OceanSalt software (malware)
  • S0239 Bankshot software (malware)
  • S0260 InvisiMole software (malware)
  • S0022 Uroburos software (malware)
  • S0031 BACKSPACE software (malware)

Referenced by Compliance · mitigates (8)

  • CIS-13.8 Deploy a Network Intrusion Prevention Solution CIS Safeguard v8.1
  • NIST-AC-4 Information Flow Enforcement NIST 800-53 control
  • NIST-CA-7 Continuous Monitoring NIST 800-53 control
  • NIST-CM-2 Baseline Configuration NIST 800-53 control
  • NIST-CM-6 Configuration Settings NIST 800-53 control
  • NIST-SC-7 Boundary Protection NIST 800-53 control
  • NIST-SI-3 Malicious Code Protection NIST 800-53 control
  • NIST-SI-4 System Monitoring NIST 800-53 control

References