AN0345: Analytic 0345
Process invokes a standard encoder (e.g., PowerShell -enc, certutil -encode, base64 via .NET/Invoke-Expression) or emits long Base64/hex literals → shortly followed by outbound network egress with high bytes_out:bytes_in ratio or HTTP headers/payloads containing Base64/MIME blocks.
Analyst context for executives and security teams
This analytic matters because it links suspicious local encoding activity on Windows to near-term outbound data movement. For leaders, the value is not simply spotting Base64 or hex strings; it is validating whether the organization can connect endpoint process behavior with network egress evidence quickly enough to support containment and data-loss decisions.
Executive priority
Prioritize this as a cross-control validation: endpoint logging, network visibility, and SOC correlation must work together. It is relevant to incident response readiness and audit evidence because a high outbound bytes-out-to-bytes-in pattern after encoding activity can indicate data staging or transfer that requires fast business impact assessment. Leaders should ask whether Windows endpoint telemetry and egress monitoring are retained, searchable, and correlated in incident timelines.
Technical view
On Windows, validate detections that correlate process invocation of common encoders or scripting patterns, such as PowerShell encoded command usage, certutil encoding, .NET/Base64-related execution, or command lines containing long Base64/hex literals, with outbound network activity shortly afterward. The network side should look for high bytes_out:bytes_in ratios and HTTP headers or payloads containing Base64/MIME-like blocks. Because no ATT&CK tactic, relationship context, or official detection logic is supplied, teams should tune this as a behavioral correlation rather than a standalone string match.
Likely telemetry
- Windows process creation events with command-line arguments
- PowerShell execution and script-block-related logs where available
- Endpoint detection telemetry for process lineage and command content
- Network connection metadata including destination, timing, bytes out, and bytes in
- HTTP proxy, web gateway, or network sensor logs with header and payload indicators where collected
Detection direction
- Correlate encoder-like process activity with outbound egress in a short time window rather than alerting only on Base64 or certutil usage.
- Tune for process lineage, user context, destination reputation/context, and volume asymmetry to reduce false positives from administrative scripts, installers, diagnostics, or legitimate certificate/file handling.
- Validate whether sensors preserve enough command-line length and network byte-count detail; truncation can hide long literals or weaken correlation.
- Check visibility gaps where endpoint events and proxy/network logs cannot be joined by host, user, process, or time.
- Review HTTP inspection and privacy constraints before relying on header or payload content indicators.
Mitigation priorities
- Ensure Windows process command-line logging and PowerShell-relevant telemetry are enabled and retained according to incident response needs.
- Maintain egress monitoring that records connection timing and byte ratios, not only allow/deny firewall events.
- Apply least-privilege and application-control principles to reduce unnecessary use of scripting and encoding utilities where business operations allow.
- Use proxy, firewall, and data-loss controls to govern unusual outbound destinations and large/asymmetric transfers.
- Document correlation coverage as compliance and IR readiness evidence, including known blind spots such as encrypted traffic or limited payload inspection.
Analyst notes and limits
The supplied object is a detection analytic, AN0345, for Windows. Its key decision value is the correlation between encoding behavior and subsequent outbound network egress. No ATT&CK tactics, technique relationships, aliases, labels, or official detection implementation were supplied, so this take avoids attribution or technique-specific claims.
The official detection field is not provided, and there is no relationship context. Local validation is required to define time windows, byte-ratio thresholds, approved encoder use cases, logging availability, and acceptable inspection depth for HTTP content. This analytic alone should not be treated as proof of compromise.
Analytic 0345
Process invokes a standard encoder (e.g., PowerShell -enc, certutil -encode, base64 via .NET/Invoke-Expression) or emits long Base64/hex literals → shortly followed by outbound network egress with high bytes_out:bytes_in ratio or HTTP headers/payloads containing Base64/MIME blocks.
How security teams should use this page
Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.
All related ATT&CK context
No relationships are available in the current normalized data for this object.
Object version and sync metadata
The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates .
Imported snapshots across ATT&CK releases (1)
| Release | Bundle imported | Object version | Modified | Status | Raw hash |
|---|---|---|---|---|---|
| 19.1 | 1.0 | Current bundle | 3143e64e5989… |
Mirrored ATT&CK source object
The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.
External references and citations
MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.
-
[1]
mitre-attack AN0345Open source URL
Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.