Description
Adversaries may encode data with a standard data encoding system to make the content of command and control traffic more difficult to detect. Command and control (C2) information can be encoded using a standard data encoding system that adheres to existing protocol specifications. Common data encoding schemes include ASCII, Unicode, hexadecimal, Base64, and MIME.(Citation: Wikipedia Binary-to-text Encoding)(Citation: Wikipedia Character Encoding) Some data encoding systems may also result in data compression, such as gzip.
Platforms
Mitigations (1)
Network Intrusion PreventionM1031
Network intrusion detection and prevention systems that use network signatures to identify traffic for specific adversary malware can be used to mitigate activity at the network level. Signatures are often for unique indicators within protocols and may be based on the specific obfuscation technique used by a particular adversary or tool, and will likely be different across various malware families
Threat Groups (11)
| ID | Group | Context |
|---|---|---|
| G0040 | Patchwork | [Patchwork](https://attack.mitre.org/groups/G0040) used Base64 to encode C2 traffic.(Citation: Cymmetria Patchwork) |
| G0125 | HAFNIUM | [HAFNIUM](https://attack.mitre.org/groups/G0125) has used ASCII encoding for C2 traffic.(Citation: Microsoft HAFNIUM March 2020) |
| G0069 | MuddyWater | [MuddyWater](https://attack.mitre.org/groups/G0069) has used tools to encode C2 communications including Base64 encoding.(Citation: ClearSky MuddyWate... |
| G0034 | Sandworm Team | [Sandworm Team](https://attack.mitre.org/groups/G0034)'s BCS-server tool uses base64 encoding and HTML tags for the communication traffic between the ... |
| G0081 | Tropic Trooper | [Tropic Trooper](https://attack.mitre.org/groups/G0081) has used base64 encoding to hide command strings delivered from the C2.(Citation: TrendMicro T... |
| G0060 | BRONZE BUTLER | Several [BRONZE BUTLER](https://attack.mitre.org/groups/G0060) tools encode data with base64 when posting it to a C2 server.(Citation: Secureworks BRO... |
| G0127 | TA551 | [TA551](https://attack.mitre.org/groups/G0127) has used encoded ASCII text for initial C2 communications.(Citation: Unit 42 Valak July 2020) |
| G1044 | APT42 | [APT42](https://attack.mitre.org/groups/G1044) has encoded C2 traffic with Base64.(Citation: Mandiant APT42-untangling) |
| G0032 | Lazarus Group | A [Lazarus Group](https://attack.mitre.org/groups/G0032) malware sample encodes data with base64.(Citation: McAfee Lazarus Resurfaces Feb 2018) |
| G0064 | APT33 | [APT33](https://attack.mitre.org/groups/G0064) has used base64 to encode command and control traffic.(Citation: FireEye APT33 Guardrail) |
| G0073 | APT19 | An [APT19](https://attack.mitre.org/groups/G0073) HTTP malware variant used Base64 to encode communications to the C2 server.(Citation: Unit 42 C0d0so... |
Associated Software (114)
| ID | Name | Type | Context |
|---|---|---|---|
| S0266 | TrickBot | Malware | [TrickBot](https://attack.mitre.org/software/S0266) can Base64-encode C2 commands.(Citation: Cyberreason Anchor December 2019) |
| S0520 | BLINDINGCAN | Malware | [BLINDINGCAN](https://attack.mitre.org/software/S0520) has encoded its C2 traffic with Base64.(Citation: US-CERT BLINDINGCAN Aug 2020) |
| S1145 | Pikabot | Malware | [Pikabot](https://attack.mitre.org/software/S1145) uses base64 encoding in conjunction with symmetric encryption mechanisms to obfuscate command and c... |
| S0543 | Spark | Malware | [Spark](https://attack.mitre.org/software/S0543) has encoded communications with the C2 server with base64.(Citation: Unit42 Molerat Mar 2020) |
| S1039 | Bumblebee | Malware | [Bumblebee](https://attack.mitre.org/software/S1039) has the ability to base64 encode C2 server responses.(Citation: Proofpoint Bumblebee April 2022) |
| S9015 | BRICKSTORM | Malware | [BRICKSTORM](https://attack.mitre.org/software/S9015) has leveraged Base64 to encode C2 communications.(Citation: NVISO BRICKSTORM April 2025)(Citatio... |
| S0678 | Torisma | Malware | [Torisma](https://attack.mitre.org/software/S0678) has encoded C2 communications with Base64.(Citation: McAfee Lazarus Nov 2020) |
| S0093 | Backdoor.Oldrea | Malware | Some [Backdoor.Oldrea](https://attack.mitre.org/software/S0093) samples use standard Base64 + bzip2, and some use standard Base64 + reverse XOR + RSA-... |
| S0603 | Stuxnet | Malware | [Stuxnet](https://attack.mitre.org/software/S0603) transforms encrypted binary data into an ASCII string in order to use it as a URL parameter value.(... |
| S1078 | RotaJakiro | Malware | [RotaJakiro](https://attack.mitre.org/software/S1078) uses ZLIB Compression to compresses data sent to the C2 server in the `payload` section network ... |
| S0184 | POWRUNER | Malware | [POWRUNER](https://attack.mitre.org/software/S0184) can use base64 encoded C2 communications.(Citation: FireEye APT34 Dec 2017) |
| S1085 | Sardonic | Malware | [Sardonic](https://attack.mitre.org/software/S1085) can encode client ID data in 32 uppercase hex characters and transfer to the actor-controlled C2 s... |
| S0083 | Misdat | Malware | [Misdat](https://attack.mitre.org/software/S0083) network traffic is Base64-encoded plaintext.(Citation: Cylance Dust Storm) |
| S1193 | TAMECAT | Malware | [TAMECAT](https://attack.mitre.org/software/S1193) has encoded C2 traffic with Base64.(Citation: Mandiant APT42-untangling) |
| S0171 | Felismus | Malware | Some [Felismus](https://attack.mitre.org/software/S0171) samples use a custom method for C2 traffic that utilizes Base64.(Citation: Forcepoint Felismu... |
| S0653 | xCaon | Malware | [xCaon](https://attack.mitre.org/software/S0653) has used Base64 to encode its C2 traffic.(Citation: Checkpoint IndigoZebra July 2021) |
| S1198 | Gomir | Malware | [Gomir](https://attack.mitre.org/software/S1198) uses Base64-encoded content in HTTP communications to command and control infrastructure.(Citation: S... |
| S0367 | Emotet | Malware | [Emotet](https://attack.mitre.org/software/S0367) has used Google’s Protobufs to serialize data sent to and from the C2 server.(Citation: Binary Defen... |
| S0409 | Machete | Malware | [Machete](https://attack.mitre.org/software/S0409) has used base64 encoding.(Citation: Securelist Machete Aug 2014) |
| S0113 | Prikormka | Malware | [Prikormka](https://attack.mitre.org/software/S0113) encodes C2 traffic with Base64.(Citation: ESET Operation Groundbait) |
References
- Gardiner, J., Cova, M., Nagaraja, S. (2014, February). Command & Control Understanding, Denying and Detecting. Retrieved April 20, 2016.
- Wikipedia. (2016, December 26). Binary-to-text encoding. Retrieved March 1, 2017.
- Wikipedia. (2017, February 19). Character Encoding. Retrieved March 1, 2017.
Frequently Asked Questions
What is T1132.001 (Standard Encoding)?
T1132.001 is a MITRE ATT&CK technique named 'Standard Encoding'. It belongs to the Command and Control tactic(s). Adversaries may encode data with a standard data encoding system to make the content of command and control traffic more difficult to detect. Command and control (C2) information can be encoded using...
How can T1132.001 be detected?
Detection of T1132.001 (Standard Encoding) typically involves monitoring system logs, network traffic, and endpoint telemetry. Use SIEM rules, EDR solutions, and behavioral analytics to identify suspicious activity associated with this technique.
What mitigations exist for T1132.001?
There are 1 documented mitigations for T1132.001. Key mitigations include: Network Intrusion Prevention.
Which threat groups use T1132.001?
Known threat groups using T1132.001 include: Patchwork, HAFNIUM, MuddyWater, Sandworm Team, Tropic Trooper, BRONZE BUTLER, TA551, APT42.