Techniques › T1132 › AN0303
AN0303 Analytic 0303
Linux · attack.mitre.org · ATT&CK Enterprise v19.2
<p>Custom scripts or processes encode outbound traffic using gzip, Base64, or hex prior to exfiltration via curl, wget, or custom sockets. Encoding typically occurs before or during outbound connections from non-network daemons.</p>
- Detects
- T1132 Data Encoding
- Part of
- DET0108 Detection Strategy for Data Encoding in C2 Channels
Log sources and channels
Exactly as MITRE states them in x_mitre_log_source_references. Where a channel is vague, it is vague in the source; kevmap does not tidy it.
| Log source | Channel | Data component |
|---|---|---|
| auditd:SYSCALL | execve | DC0032 Process Creation |
| NSM:Flow | Base64 strings or gzip in URI, headers, or POST body | DC0085 Network Traffic Content |
| linux:syslog | Unusual outbound transfers from CLI tools like base64, gzip, or netcat | DC0064 Command Execution |
Mutable elements
Parameters MITRE marks as environment-specific. These are the knobs you are expected to tune; they are why an analytic is not a rule.
| Field | Description |
|---|---|
TimeWindow | Tune duration of multi-stage encoding + transfer operations to account for script variability |
UserContext | Apply user allow/block list depending on which users normally perform CLI encoding |