Detecting Data Encoding in Command and Control Traffic (T1132)

T1132, Data Encoding, sits under the command and control tactic. Adversaries encode the content of their C2 traffic so it is harder to recognize. It applies to ESXi, Linux, macOS and Windows.

MITRE splits it into two sub-techniques: standard encoding (T1132.001) and non-standard encoding (T1132.002). The parent covers both. Schemes include ASCII, Unicode, Base64, MIME and other binary-to-text systems. Some, such as gzip, also compress the data.

How attackers use it

Encoding lets C2 data follow an existing protocol while hiding what it says. A beacon that sends Base64 text in an HTTP header or cookie looks like web traffic at a glance. Encoded content also dodges simple string matching on the wire.

This is a property of the channel, not a single tool. MITRE's page lists many malware families and tools that encode their C2, among them BADNEWS, Mythic and Ursnif.

How to detect it

MITRE's detection strategy covers each platform:

• Windows. Unusual processes such as powershell.exe or regsvr32.exe encode large outbound data using Base64 or similar, sent over uncommon ports or tucked into protocol fields such as HTTP cookies or headers.
• Linux. Scripts or processes use gzip, Base64 or hex before sending data with curl, wget or custom sockets. The encoding often happens in processes that are not network daemons.
• macOS. Built-in tools such as base64, xxd or plutil encode file contents, followed by an HTTP or HTTPS transfer.
• ESXi. Daemons such as hostd and vpxa are wrapped or impersonated to send large encoded outbound traffic over SSH or HTTP, after suspicious logins or shell access.

Combine two views. On the host, look at process creation with command lines. On the network, look at flows where outbound bytes far exceed inbound bytes and at Base64 or MIME blocks in headers and bodies from processes that rarely talk to the internet.

How to reduce the risk

MITRE lists network intrusion prevention. Signatures can flag specific adversary malware by unique indicators within protocols, sometimes based on the obfuscation method a particular tool uses. The caveat in the source is worth repeating: signatures differ across malware families, so they catch known tools and need regular updates.

Also reduce what encoded traffic can reach. Egress filtering, proxying outbound web traffic and logging headers all give you something to inspect.

Quick check

Sources

• MITRE ATT&CK, T1132 Data Encoding