Techniques › T1132 › T1132.002
T1132.002 Non-Standard Encoding
command and control — ESXi, Linux, macOS, Windows · attack.mitre.org · JSON
1
MITRE detection strategy
4
analytics
0
Sigma rules tagged attack.t1132.002
0
KEV CVEs mapped here
<p>Adversaries may encode data with a non-standard data encoding system to make the content of command and control traffic more difficult to detect. Command and control (C2) information can be encoded using a non-standard data encoding system that diverges from existing protocol specifications. Non-standard data encoding schemes may be based on or related to standard data encoding schemes, such as a modified Base64 encoding for the message body of an HTTP request.</p>
KEV CVEs mapped to this technique · CTID Mappings Explorer
None. No KEV entry in the public mapping names this technique. Given that 74.7% of KEV has no mapping at all, this says more about the mapping than about the technique.
Detection strategy · ATT&CK Enterprise v19.2
- DET0326 Behavior-chain detection for T1132.002 Data Encoding: Non-Standard Encoding across Windows, Linux, macOS, ESXi v1.0
AN0927 WindowsA process/script constructs or references a custom/alphabet translation table (e.g., 64/85/32+ arbitrary chars, XOR/base-N loops) or emits long high-entropy strings that do NOT validate as standard Base64/Hex → shortly after, the same process (or its child) generates outbound traffic with asymmetric bytes_out:bytes_in, fixed-size beacons, or protocol/header mismatches (e.g., Content-Type says JSON but body fails JSON parse / contains non-standard alphabet).m365:defender
NetworkConnection: high out:in ratio, periodic beacons, protocol mismatch→ DC0078 Network Traffic FlowTunable:EntropyThresholdTokenLengthThresholdBytesOutToInRatioFixedPacketStdDevThresholdTimeWindowKnownLegitEncodersAN0928 LinuxShell scripts or binaries implement custom mapping tables (tr/sed/awk/golang/rust/python encode loops), or emit long high-entropy tokens that fail Base64/Hex validation → correlated with egress showing asymmetric flow, protocol-mismatch payloads, or DNS/HTTP bodies containing low-diversity-but-long custom alphabets.auditd:SYSCALLexecve of interpreters (python, perl), custom binaries, or shell utilities with long arguments containing non-standard tokens→ DC0032 Process CreationNSM:Flowhttp: HTTP bodies/headers contain long tokens with non-standard alphabets or constant-size periodic POSTs→ DC0085 Network Traffic ContentTunable:EntropyThresholdTokenLengthThresholdBytesOutToInRatioTimeWindowKnownEncodersAN0929 macOSEndpointSecurity/Unified Logs show processes generating custom alphabets or long high-entropy, non-standard tokens → network logs (PF/Zeek/EDR) show asymmetric beacons, protocol mismatches, or periodic fixed-size posts.macos:endpointsecurityES_EVENT_TYPE_NOTIFY_EXEC: arguments contain long, non-standard tokens / custom alphabets→ DC0032 Process CreationNSM:Flowhttp: suspicious long tokens with custom alphabets in body/headers→ DC0085 Network Traffic ContentTunable:EntropyThresholdTokenLengthThresholdBytesOutToInRatioTimeWindowAllowedSignedBinariesAN0930 ESXiESXi shell or scripts produce long, high-entropy tokens (non-standard alphabets) in shell.log/hostd, followed by outbound flows (NSX/Zeek) with asymmetric ratios or protocol mismatches to non-management endpoints.esxi:shellcommands containing long non-standard tokens or custom lookup tables→ DC0032 Process Creationesxi:hostdunexpected script invocations producing long encoded strings→ DC0038 Application Log ContentNSM:Flownetwork_flow: bytes_out >> bytes_in, fixed packet sizes/intervals to non-approved CIDRs→ DC0078 Network Traffic FlowNSM:Flowhttp: HTTP bodies from ESXi host IPs containing long, non-standard tokens→ DC0085 Network Traffic ContentTunable:MgmtCIDRsBytesOutToInRatioTokenLengthThresholdTimeWindow
Sigma rules · SigmaHQ da9bb07d64, tag attack.t1132.002
No Sigma rule carries this tag. MITRE publishes a detection strategy above, so the behaviour is specified; what is missing is public detection content.