Data Encoding T1132

Tactic: Command & Control

Adversaries may encode data to make the content of command and control traffic more difficult to detect. Command and control (C2) information can be encoded using a standard data encoding system. Use of data encoding may adhere to existing protocol specifications and includes use of ASCII, Unicode, Base64, MIME, or other binary-to-text and character encoding systems. Some data encoding systems may also result in data compression, such as gzip.

Events covered

5 catalog events are tagged with this technique by at least one rule.

Authoring guide

Patterns shared across the 15 rules above: which fields they filter on, what specific values they look for, and what they exclude. The catalog normalizes field names across vendors so Sigma's Image, Elastic's process.name, and Splunk's process_name collapse into one row. Each rule contributes at most once per row.

Fields filtered most (16 distinct)

The fields most rules look at when detecting this technique. The How column shows the operators authors use (eq, wildcard, regex_match, match) and how often each appears. Sample values are concrete examples to start from, not an exhaustive list.

FieldRulesHowSample values
CommandLine5match 3, contains 2(?i)-encode, ::decompress, frombase64string, gzipstream, h4si
EventID5eq 51, 4688, 4103, 4104
Type3eq 3
process_name3match 2, in 1(?i)certutil, base16, base32, base32hex
EventType2eq 1, in 1ProcessRollup2, exec, exec_event, proxylogs
Image2contains 1, ends_with 1, is_not_null 1\dnscat2, \iodine.exe
event.type2eq 1, in 1change, creation, start
Action1eq 1Blocked
HttpUserAgentOriginal1contains 1windowspowershell
LogType1eq 1Agent Traffic Logs
ScriptBlockText1contains 1frombase64string, h4si, memorystream
TotalBlockedEvents1gt 115
event_type1in 1childproc, netconn, proc
file.Ext.header_bytes1starts_with 11F8B, 1F9D, 1FA0
host.os.type1eq 1

Top indicator values (69 distinct)

Specific (field, operator, value) combinations the rules check for, ranked by how many rules under this technique use each one. The Corpus reach column counts how many rules across the entire catalog (any technique) check the same combination. High numbers point to widely-used indicators that are likely noisy on their own; combine them with another condition for useful signal. Blank means the combination is specific to rules under this technique. Click a value to expand the rules under this technique that use it.

FieldKindValueRules (here)Corpus reach
CommandLinematch
(?i)-encode
33
EventIDeq
1
2237
EventIDeq
4688
2313
EventIDeq
4103
1105
EventIDeq
4104
1268
process_namematch
(?i)certutil
24
Actioneq
Blocked
16
CommandLinecontains
::decompress
1
CommandLinecontains
frombase64string
112
CommandLinecontains
gzipstream
1
CommandLinecontains
h4si
1
CommandLinecontains
memorystream
1
EventTypeeq
proxylogs
120
EventTypein
ProcessRollup2
1117
EventTypein
exec
1171
EventTypein
exec_event
1139
EventTypein
executed
188
EventTypein
process_started
174
EventTypein
start
1134
HttpUserAgentOriginalcontains
windowspowershell
12
Imagecontains
\dnscat2
1
Imageends_with
\iodine.exe
1
LogTypeeq
Agent Traffic Logs
1
ScriptBlockTextcontains
frombase64string
14
ScriptBlockTextcontains
h4si
1
ScriptBlockTextcontains
memorystream
1
TotalBlockedEventsgt
15
1
event.typeeq
start
1606
event.typein
change
116
event.typein
creation
115

Exclusions (2 distinct)

Field/operator/value combinations excluded by rules under this technique (top-level not() clauses), sorted by how many rules exclude each. These are the false-positive paths the community has learned to filter out. A new rule that ignores the high-count entries here will likely fire on the same noisy paths. Click a value to expand the rules under this technique that exclude it.

FieldKindValueRules excluding
process.argsin
--help
1
process.argsin
--version
1

Rules under this technique

Every rule in the catalog tagged with this technique, grouped by vendor. Click a rule title for its full predicates, exclusions, and indicators.

Platform (all)
Domain (all)

Sigma 4 rules

Elastic 2 rules

Splunk 6 rules

Kusto 3 rules