T1132.002 — Non-Standard Encoding

Tactic: Command and Control · Platforms: ESXi, Linux, macOS, Windows

Adversaries may encode data with a non-standard data encoding system to make the content of command and control traffic more difficult to detect. Command and control (C2) information can be encoded using a non-standard data encoding system that diverges from existing protocol specifications.…

Sub-technique of Data Encoding (T1132).

Sigma detection rules (4)

title: "T1132.002 Data Encoding: Non-Standard Encoding"
id: ac02bd2a-5c99-4d24-a697-11328ea1dda7
description: 'Detects DNS queries whose leading subdomain label is an abnormally long alphanumeric string, characteristic of non-standard/custom encoding schemes used to tunnel C2 data through DNS, alongside network connections from encode-capable LOLBins. (Data Component: Network Connection Creation; baseline tier: windows-eventid.) Tune using: EntropyThreshold, TokenLengthThreshold, BytesOutToInRatio, FixedPacketStdDevThreshold, TimeWindow, KnownLegitEncoders.'
references:
  - https://attack.mitre.org/techniques/T1132/002
author: Shahrukh Khan
date: 2026-01-20
license: MIT
tags:
  - attack.command-and-control
  - attack.t1132.002

logsource:
  product: windows
  service: sysmon

detection:
  selection_dns_encoded_label:
    EventID: '22'
    QueryName|re: '^[a-zA-Z0-9]{32,}\.'

  selection_network_lolbin:
    EventID: '3'
    Image|endswith:
      - '\certutil.exe'
      - '\powershell.exe'
      - '\bitsadmin.exe'
      - '\wscript.exe'
      - '\cscript.exe'

  filter_system_account:
    User|contains:
      - 'SYSTEM'
      - 'LOCAL SERVICE'
      - 'NETWORK SERVICE'

  condition: (selection_dns_encoded_label or selection_network_lolbin) and not filter_system_account

falsepositives:
  - CDN/cloud provider hostnames and some anti-malware/telemetry services use long random subdomain labels.

level: medium

title: "T1132.002 Data Encoding: Non-Standard Encoding"
id: ea3c68a6-0484-4c1e-ab62-3044b27b1711
description: 'Detects PowerShell execution that combines non-standard/custom data-encoding operations (XOR, character-array manipulation, custom replace-based ciphers) with outbound network activity, while excluding standard Base64 encoding via certutil or FromBase64String/ToBase64String (which is T1132.001''s signature, not this technique''s). Tune using: EntropyThreshold, TokenLengthThreshold, BytesOutToInRatio, TimeWindow, KnownEncoders.'
references:
  - https://attack.mitre.org/techniques/T1132/002
author: Shahrukh Khan
date: 2026-01-27
license: MIT
tags:
  - attack.command-and-control
  - attack.t1132.002

logsource:
  category: process_creation
  product: windows
  service: sysmon

detection:
  selection_custom_encode:
    Image|endswith: '\powershell.exe'
    CommandLine|contains:
      - '-bxor'
      - 'ToCharArray()'
      - '[char[]]'
      - '.Replace('
  selection_network:
    CommandLine|contains:
      - 'Invoke-WebRequest'
      - 'Net.WebClient'
      - 'Invoke-RestMethod'
      - 'DownloadString'
      - 'DownloadData'
  filter_standard_encode:
    CommandLine|contains:
      - 'FromBase64String'
      - 'ToBase64String'
      - 'certutil'

  condition: selection_custom_encode and selection_network and not filter_standard_encode

falsepositives:
  - Legitimate use of custom string encoding/obfuscation techniques in administrative or automation scripts combined with normal network calls; review script provenance and destination before escalating.

level: high

title: "T1132.002 Data Encoding: Non-Standard Encoding"
id: eee541d8-2e36-4c89-9bb1-303d2db41b94
description: 'Behavior-chain detection for T1132.002 Data Encoding: Non-Standard Encoding across Windows, Linux, macOS, ESXi. (Retargeted to the process_creation macOS unified-log telemetry that actually captures this techniques behavior; see logsource below.) Tune using: EntropyThreshold, TokenLengthThreshold, BytesOutToInRatio, TimeWindow, AllowedSignedBinaries.'
references:
  - https://attack.mitre.org/techniques/T1132/002
author: Shahrukh Khan
date: 2026-03-05
license: MIT
tags:
  - attack.command-and-control
  - attack.t1132.002

logsource:
  category: process_creation
  product: macos

detection:
  selection:
    CommandLine|contains:
      - 'openssl enc'
      - 'xxd -r'

  condition: selection

falsepositives:
  - Developers legitimately use openssl enc or xxd for encoding and decoding during debugging or cryptography testing.

level: medium

title: "T1132.002 Data Encoding: Non-Standard Encoding"
id: e1d12ed0-e9c2-4de3-98f1-7107dda5d9dd
description: 'Behavior-chain detection for T1132.002 Data Encoding: Non-Standard Encoding across Windows, Linux, macOS, ESXi. (Retargeted to the process_creation ESXi telemetry that actually captures this techniques behavior; see logsource below.) Tune using: MgmtCIDRs, BytesOutToInRatio, TokenLengthThreshold, TimeWindow.'
references:
  - https://attack.mitre.org/techniques/T1132/002
author: Shahrukh Khan
date: 2026-03-26
license: MIT
tags:
  - attack.command-and-control
  - attack.t1132.002

logsource:
  category: process_creation
  product: esxi
  service: shell

detection:
  selection:
    CommandLine|contains:
      - 'uuencode'
      - 'xxd -r'
      - 'tr -d'
      - 'rot13'

  condition: selection

falsepositives:
  - Custom or non-standard encoding is by definition hard to enumerate; these utilities are also used for legitimate text manipulation, and ESXi has no token-length or byte-ratio telemetry to separate malicious use from routine scripting.

level: low

Related sub-techniques

• T1132.001 Standard Encoding

Explore

• All Sigma rules for MITRE ATT&CK
• Sigma rule format guide
• Full T1132.002 intelligence — ATT&CK Intelligence View
• Official MITRE ATT&CK entry
• Built by Shahrukh Khan