T1132.001 — Standard Encoding

Tactic: Command and Control · Platforms: ESXi, Linux, macOS, Windows

Adversaries may encode data with a standard data encoding system to make the content of command and control traffic more difficult to detect. Command and control (C2) information can be encoded using a standard data encoding system that adheres to existing protocol specifications. Common data…

Sub-technique of Data Encoding (T1132).

Sigma detection rules (4)

title: "T1132.001 Data Encoding: Standard Encoding"
id: bc37a677-664e-47d4-bb08-a7a9a3fb6bf2
description: 'Detects DNS queries with long base64/hex-alphabet subdomain labels, proxying content encoding via the DNS query field. (Data Component: DNS Query; baseline tier: windows-eventid.) Tune using: PayloadEntropyThreshold, B64LengthThreshold, TimeWindow, KnownAdminTools, BytesOutToInRatio.'
references:
  - https://attack.mitre.org/techniques/T1132/001
author: Shahrukh Khan
date: 2026-03-04
license: MIT
tags:
  - attack.command-and-control
  - attack.t1132.001

logsource:
  category: dns_query
  product: windows
  service: sysmon

detection:
  selection_encoded_label:
    QueryName|re: '(^|\.)[A-Za-z0-9+/]{40,}(\.|$)'
  filter_common:
    QueryName|contains:
      - 'microsoft.com'
      - 'windowsupdate.com'
      - 'office.com'
  condition: selection_encoded_label and not filter_common

falsepositives:
  - CDN/ad-tech long subdomain labels.

level: medium

title: "T1132.001 Data Encoding: Standard Encoding"
id: c6d82fd3-f425-4fe8-979c-524cda98cb6e
description: 'Proxies standard-encoding usage via certutil -encode/-decode or PowerShell Base64 cmdlets. (Data Component: Process Creation; baseline tier: windows-eventid.) Tune using: EncodingToolsAllowList, EntropyThreshold, TimeWindow, OutInRatio.'
references:
  - https://attack.mitre.org/techniques/T1132/001
author: Shahrukh Khan
date: 2026-04-16
license: MIT
tags:
  - attack.command-and-control
  - attack.t1132.001

logsource:
  category: process_creation
  product: windows
  service: sysmon

detection:
  selection_certutil:
    EventID: '1'
    Image|endswith: '\certutil.exe'
    CommandLine|contains:
      - '-encode'
      - '-decode'
      - '/encode'
      - '/decode'
  selection_powershell_b64:
    EventID: '1'
    CommandLine|contains:
      - 'FromBase64String'
      - 'ToBase64String'
      - '-EncodedCommand'
      - '-enc '
  filter_system_account:
    User|contains:
      - 'SYSTEM'
      - 'LOCAL SERVICE'
      - 'NETWORK SERVICE'
  condition: (selection_certutil or selection_powershell_b64) and not filter_system_account

falsepositives:
  - Legitimate certutil/PowerShell Base64 automation.

level: medium

title: "T1132.001 Data Encoding: Standard Encoding"
id: 7b24a586-bdde-4030-9483-e98e008273df
description: 'Behavior-chain detection for T1132.001 Data Encoding: Standard Encoding (Base64/Hex/MIME) across Windows, Linux, macOS, ESXi. (Retargeted to the process_creation macOS unified-log telemetry that actually captures this techniques behavior; see logsource below.) Tune using: AllowedDeveloperIDs, EntropyThreshold, TimeWindow.'
references:
  - https://attack.mitre.org/techniques/T1132/001
author: Shahrukh Khan
date: 2026-04-26
license: MIT
tags:
  - attack.command-and-control
  - attack.t1132.001

logsource:
  category: process_creation
  product: macos

detection:
  selection:
    Image|endswith: '/base64'
    CommandLine|contains: '-D'

  condition: selection

falsepositives:
  - Standard base64 decoding is used broadly by legitimate scripts, package managers, and CI pipelines.

level: low

title: "T1132.001 Data Encoding: Standard Encoding"
id: c92e1256-f251-4d5f-ba4b-0afec77b633b
description: 'Behavior-chain detection for T1132.001 Data Encoding: Standard Encoding (Base64/Hex/MIME) across Windows, Linux, macOS, ESXi. (Retargeted to the process_creation ESXi telemetry that actually captures this techniques behavior; see logsource below.) Tune using: MgmtCIDRs, BytesRatio, TimeWindow.'
references:
  - https://attack.mitre.org/techniques/T1132/001
author: Shahrukh Khan
date: 2026-04-12
license: MIT
tags:
  - attack.command-and-control
  - attack.t1132.001

logsource:
  category: process_creation
  product: esxi
  service: shell

detection:
  selection_encode:
    CommandLine|contains:
      - 'base64'
  selection_network:
    CommandLine|contains:
      - 'curl '
      - 'nc '
      - 'netcat'

  condition: selection_encode and selection_network

falsepositives:
  - Legitimate scripts that base64-encode a payload before transmitting it over an already-approved management channel; ESXi shell.log has no byte-ratio metric to distinguish this from benign transfers.

level: medium

Related sub-techniques

• T1132.002 Non-Standard Encoding

Explore

• All Sigma rules for MITRE ATT&CK
• Sigma rule format guide
• Full T1132.001 intelligence — ATT&CK Intelligence View
• Official MITRE ATT&CK entry
• Built by Shahrukh Khan