T1132.002 covers command and control traffic encoded with a scheme that diverges from existing protocol specifications. MITRE's example is a modified Base64 encoding for the body of an HTTP request. The tactic is command and control, and it applies to ESXi, Linux, macOS and Windows.
Standard encodings are easy to decode in a proxy or sandbox. A custom alphabet is not, which is why some malware families build their own.
How attackers use it
The scheme may be based on a standard one, with changes that stop common decoders from working. The traffic can still ride inside ordinary protocols such as HTTP. MITRE's page lists a range of malware that does this, including Cyclops Blink, InvisiMole and Kimsuky tooling.
How to detect it
MITRE describes a chain across platforms:
- A process or script builds or references a custom translation table, such as an alphabet of 64 or more arbitrary characters, or loops that apply XOR or base-N transforms. Or it emits long high-entropy strings that fail to validate as standard Base64 or hex.
- Shortly after, that process or its child generates outbound traffic with a lopsided bytes out to bytes in ratio, fixed-size beacons, or protocol mismatches. One example from the page is a Content-Type that says JSON while the body does not parse as JSON.
Platform variants cover shell scripts using tr, sed or awk mapping tables on Linux, Endpoint Security and Unified Logs on macOS, and shell.log and hostd on ESXi, each followed by outbound flows to non-management endpoints.
The most practical network signal is mismatch. A body that claims to be one thing and parses as another is cheap to test at a proxy, and so are periodic posts of identical size.
How to reduce the risk
MITRE lists network intrusion prevention. Signatures based on unique protocol indicators can catch specific tools, though they differ across malware families. Combine them with egress filtering and content-type validation at your web proxy.
Quick check
What is one network tell for a non-standard encoding?
A protocol mismatch, such as a Content-Type of JSON on a body that fails to parse as JSON, or fixed-size periodic beacons.
Sources
- MITRE ATT&CK, T1132.002 Non-Standard Encoding
