T1132.001 covers adversaries who encode command and control traffic with a standard scheme that follows existing protocol specifications. MITRE names ASCII, Unicode, hexadecimal, Base64 and MIME as common choices, and notes some encodings also compress the data, as gzip does. The tactic is command and control. It applies to ESXi, Linux, macOS and Windows.
The hard part for defenders is that these encodings are normal. Email, web APIs and config files use them constantly. A detection that fires on Base64 alone will bury you.
How attackers use it
The encoded data still obeys the protocol. A message body, header or DNS field holds text that is valid Base64 or hex, so the traffic passes basic format checks while hiding the real content. MITRE's page lists many tools and malware that do this, including certutil as a utility and families such as ADVSTORESHELL and BabyShark.
How to detect it
MITRE frames this as a behavior chain: a process runs an encoder, then shortly after sends data out with a lopsided ratio of bytes out to bytes in, or with Base64 or MIME blocks in HTTP headers or payloads.
By platform:
- Windows. PowerShell with
-enc,certutil -encode, or Base64 handled through .NET, or very long Base64 or hex literals, followed by outbound traffic. - Linux.
base64,xxd -p,od,openssl enc -base64, or Python and Perl base64 libraries, followed bycurl,wget, bash TCP,socator Python requests. Look at Base64 or MIME blobs in HTTP or DNS payloads. - macOS.
base64,xxd,opensslor Python Objective-C APIs, seen in Endpoint Security exec events or Unified Logs, then quick outbound connections with large uploads or HTTP POSTs with Base64 bodies. - ESXi. The BusyBox shell or VMware utilities encoding datastore or config data, then abnormal egress or HTTPS posts to endpoints that are not management endpoints.
The time gap between encoding and sending is the key correlation. One event alone is weak. Both together, from a process that has no reason to do either, is worth a look.
How to reduce the risk
MITRE lists network intrusion prevention. Network signatures can match unique indicators within protocols, and may be based on the exact obfuscation a tool uses. They will differ across malware families, so keep them current and treat them as one layer next to host logging and egress control.
Quick check
Why is Base64 alone a poor detection signal?
Normal software uses it all the time. The signal is encoding followed by lopsided outbound traffic from a process that should not do either.
Sources
- MITRE ATT&CK, T1132.001 Standard Encoding
