Live Active security incident? Get immediate response
MITRE ATT&CK® Technique

T1132.001: Standard Encoding

Adversaries may encode data with a standard data encoding system to make the content of command and control traffic more difficult to detect. Command and control (C2) information can be encoded using a standard data encoding system that adheres to existing protocol specifications. Common data encoding schemes include ASCII, Unicode, hexadecimal, Base64, and MIME.[1][2] Some data encoding systems may also result in data compression, such as gzip.

EnterpriseT1132.001Sub-techniqueObject v1.1 Modified
Discuss defensive coverage Back to ATT&CK
Glexia's Take

Analyst context for executives and security teams

Analyst confidence Medium

Standard Encoding matters because normal-looking encodings such as Base64, hex, ASCII, Unicode, MIME, or gzip can be used to make command-and-control content harder to inspect without violating protocol expectations. For leaders, the practical issue is not that encoding is malicious by itself; it is that common business traffic can hide C2 signals unless network inspection, SOC triage, and incident response workflows can correlate encoded content with suspicious behavior.

Executive priority

Treat this as a coverage-validation topic for command-and-control resilience. Ask whether network boundary controls, SOC detections, and IR playbooks can recognize suspicious encoded C2 patterns across Windows, Linux, macOS, and ESXi environments without relying on encoding alone as proof of compromise. The attached mitigation relationship points to network intrusion prevention, so priority should be on proving that boundary IDS/IPS controls are deployed, tuned, and producing usable evidence for investigations and compliance reporting.

Technical view

ATT&CK provides no native detection text for T1132.001, but relationship context identifies DET0124 as a behavior-chain detection strategy for Standard Encoding across Windows, Linux, macOS, and ESXi. SOC teams should validate detections that combine encoded payload indicators with C2 context, such as unusual outbound sessions, repeated encoded-looking parameters or bodies, MIME/Base64/hex-heavy content, and corroborating endpoint or network events. Because standard encodings are legitimate, detection should be correlation-driven rather than simple string matching.

Likely telemetry

  • Network IDS/IPS alerts and signatures at network boundaries
  • Proxy, firewall, and egress connection logs
  • HTTP or other protocol metadata where C2 traffic may carry encoded parameters, headers, or bodies
  • Packet capture or retained payload samples where legally and operationally permitted
  • Endpoint process, command-line, and network-connection context for Windows, Linux, macOS, and ESXi where available

Detection direction

  • Validate DET0124-style behavior-chain analytics rather than standalone Base64, hex, MIME, gzip, ASCII, or Unicode matches.
  • Tune for false positives from legitimate applications, APIs, file transfers, email/MIME handling, compression, and administrative tooling.
  • Correlate encoded content patterns with destination reputation, egress anomalies, beacon-like behavior, unusual user or host context, and related malware or campaign intelligence where available.
  • Confirm visibility across the listed platforms, especially ESXi and non-Windows systems that may have weaker endpoint telemetry.
  • Test whether IDS/IPS and SOC workflows preserve enough payload or metadata to explain why an encoded session was escalated.

Mitigation priorities

  • Prioritize network intrusion prevention at network boundaries, consistent with ATT&CK mitigation M1031.
  • Ensure IDS/IPS signatures and inspection policies can flag suspicious encoded C2 traffic without broadly blocking legitimate encoded business traffic.
  • Use egress control and monitoring to limit and review outbound communications from sensitive systems.
  • Maintain investigation playbooks for decoding or safely handling captured encoded artifacts during incident response.
  • Document detection logic, tuning decisions, and control evidence for audit and compliance readiness.
Analyst notes and limits

This technique is a sub-technique of Data Encoding under the command-and-control tactic. Relationship context shows use by multiple ATT&CK groups, software entries, and the Juicy Mix campaign, which supports treating it as a broadly relevant C2 tradecraft pattern. Those relationships should inform threat-informed detection testing, but they do not prove activity in any specific environment.

Official ATT&CK detection guidance is not provided for this object. The object describes standard encoding categories but does not provide protocol-specific indicators, signatures, or guaranteed detection methods. Local traffic baselines, inspection capability, privacy constraints, and platform telemetry determine practical coverage.

Official MITRE ATT&CK definition

Standard Encoding

Adversaries may encode data with a standard data encoding system to make the content of command and control traffic more difficult to detect. Command and control (C2) information can be encoded using a standard data encoding system that adheres to existing protocol specifications. Common data encoding schemes include ASCII, Unicode, hexadecimal, Base64, and MIME.[1][2] Some data encoding systems may also result in data compression, such as gzip.

View the same entry on attack.mitre.org (MITRE-hosted reference; in-page links above use the Glexia ATT&CK library.)

Glexia analysis

How security teams should use this page

Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.

ATT&CK relationship table

Related techniques

This mirrors the MITRE pattern of making group, software, campaign, and technique relationships scannable. Relationship notes come from mirrored ATT&CK relationship text when available.

1 rows
Domain ID Name Relationship / procedure
Enterprise T1132 Data Encoding This object subtechnique of Data Encoding.
Associated objects

Groups, software, and campaigns

Group Enterprise

G0034: Sandworm Team

Sandworm Team is a destructive threat group that has been attributed to Russia's General Staff Main Intelligence Directorate (GRU) Main Center for Special Technologies (GTsST) military unit 74455.[1][2] This group has been active since at least 2009.[3][4][5][6]

In October 2020, the US indicted six GRU Unit 74455 officers associated with Sandworm Team for the following cyber operations: the 2015 and 2016 attacks against Ukrainian electrical companies and government organizations, the 2017 worldwide NotPetya attack, targeting of the 2017 French presidential campaign, the 2018 Olympic Destroyer attack against the Winter Olympic Games, the 2018 operation against the Organisation for the Prohibition of Chemical Weapons, and attacks against the country of Georgia in 2018 and 2019.[1][2] Some of these were conducted with the assistance of GRU Unit 26165, which is also referred to as APT28.[7]

Group Enterprise

G0040: Patchwork

Patchwork is a cyber espionage group that was first observed in December 2015. While the group has not been definitively attributed, circumstantial evidence suggests the group may be a pro-Indian or Indian entity. Patchwork has been seen targeting industries related to diplomatic and government agencies. Much of the code used by this group was copied and pasted from online forums. Patchwork was also seen operating spearphishing campaigns targeting U.S. think tank groups in March and April of 2018.[1] [2][3][4]

Group Enterprise

G1044: APT42

APT42 is an Iranian-sponsored threat group that conducts cyber espionage and surveillance.[1] The group primarily focuses on targets in the Middle East region, but has targeted a variety of industries and countries since at least 2015.[1] APT42 starts cyber operations through spearphishing emails and/or the PINEFLOWER Android malware, then monitors and collects information from the compromised systems and devices.[1] Finally, APT42 exfiltrates data using native features and open-source tools.[2]

APT42 activities have been linked to Magic Hound by other commercial vendors. While there are behavior and software overlaps between Magic Hound and APT42, they appear to be distinct entities and are tracked as separate entities by their originating vendor.

Group Enterprise

G0060: BRONZE BUTLER

BRONZE BUTLER is a cyber espionage group with likely Chinese origins that has been active since at least 2008. The group primarily targets Japanese organizations, particularly those in government, biotechnology, electronics manufacturing, and industrial chemistry.[1][2][3]

Group Enterprise

G0127: TA551

TA551 is a financially-motivated threat group that has been active since at least 2018. [1] The group has primarily targeted English, German, Italian, and Japanese speakers through email-based malware distribution campaigns. [2]

Group Enterprise

G0032: Lazarus Group

Lazarus Group is a North Korean state-sponsored cyber threat group attributed to the Reconnaissance General Bureau (RGB). [1] [2] Lazarus Group has been active since at least 2009 and is reportedly responsible for the November 2014 destructive wiper attack on Sony Pictures Entertainment, identified by Novetta as part of Operation Blockbuster. Malware used by Lazarus Group correlates to other reported campaigns, including Operation Flame, Operation 1Mission, Operation Troy, DarkSeoul, and Ten Days of Rain.[3]

North Korea’s cyber operations have shown a consistent pattern of adaptation, forming and reorganizing units as national priorities shift. These units frequently share personnel, infrastructure, malware, and tradecraft, making it difficult to attribute specific operations with high confidence. Public reporting often uses “Lazarus Group” as an umbrella term for multiple North Korean cyber operators conducting espionage, destructive attacks, and financially motivated campaigns.[4][5][6]

Malware Enterprise

S1021: DnsSystem

DnsSystem is a .NET based DNS backdoor, which is a customized version of the open source tool DIG.net, that has been used by HEXANE since at least June 2022.[1]

Windows
Malware Enterprise

S0045: ADVSTORESHELL

ADVSTORESHELL is a spying backdoor that has been used by APT28 from at least 2012 to 2016. It is generally used for long-term espionage and is deployed on targets deemed interesting after a reconnaissance phase. [1] [2]

Windows
Malware Enterprise

S0696: Flagpro

Flagpro is a Windows-based, first-stage downloader that has been used by BlackTech since at least October 2020. It has primarily been used against defense, media, and communications companies in Japan.[1]

Windows
Malware Enterprise

S0603: Stuxnet

Stuxnet was the first publicly reported malware to specifically target industrial control systems devices. Stuxnet is a large and complex malware that utilized multiple behaviors, including numerous zero-day vulnerabilities, a sophisticated Windows rootkit, and network infection routines.[1][2][3][4] Stuxnet was discovered in 2010, with some components being used as early as November 2008.[1]

Windows
Malware Enterprise

S1160: Latrodectus

Latrodectus is a Windows malware downloader that has been used since at least 2023 to download and execute additional payloads and modules. Latrodectus has most often been distributed through email campaigns, primarily by TA577 and TA578, and has infrastructure overlaps with historic IcedID operations.[1][2][3]

Windows
Malware Enterprise

S0631: Chaes

Chaes is a multistage information stealer written in several programming languages that collects login credentials, credit card numbers, and other financial information. Chaes was first observed in 2020, and appears to primarily target victims in Brazil as well as other e-commerce customers in Latin America.[1]

Windows
Malware Enterprise

S1020: Kevin

Kevin is a backdoor implant written in C++ that has been used by HEXANE since at least June 2020, including in operations against organizations in Tunisia.[1]

Windows
Relationship explorer

All related ATT&CK context

detects · Detection Strategy DET0124: Behavior-chain detection for T1132.001 Data Encoding: Standard Encoding (Base64/Hex/MIME) across Windows, Linux, macOS, ESXi Enterprise uses · Malware S0610: SideTwist Enterprise uses · Malware S0410: Fysbis Enterprise uses · Malware S1021: DnsSystem Enterprise uses · Malware S0045: ADVSTORESHELL Enterprise uses · Malware S0696: Flagpro Enterprise uses · Malware S0603: Stuxnet Enterprise uses · Malware S0053: SeaDuke Enterprise uses · Malware S1160: Latrodectus Enterprise uses · Malware S1196: Troll Stealer Enterprise uses · Group G0034: Sandworm Team Enterprise uses · Malware S0663: SysUpdate Enterprise uses · Malware S0631: Chaes Enterprise uses · Malware S1020: Kevin Enterprise uses · Malware S0472: down_new Enterprise uses · Group G0040: Patchwork Enterprise uses · Malware S0678: Torisma Enterprise uses · Malware S0044: JHUHUGIT Enterprise uses · Malware S0559: SUNBURST Enterprise uses · Malware S1060: Mafalda Enterprise uses · Malware S0649: SMOKEDHAM Enterprise uses · Malware S1110: SLIGHTPULSE Enterprise subtechnique of · Technique T1132: Data Encoding Enterprise uses · Malware S0137: CORESHELL Enterprise
Change history

Object version and sync metadata

The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates .

ATT&CK release
19.1
Object version
1.1
Created
Modified
Raw hash
72b8e584169f2cb3...
Imported snapshots across ATT&CK releases (1)
Release Bundle imported Object version Modified Status Raw hash
19.1 1.1 Current bundle 72b8e584169f…
Raw source

Mirrored ATT&CK source object

The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.

Open mirrored raw JSON Open MITRE-hosted copy
Source references

External references and citations

MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.

  1. [1]
    Wikipedia Binary-to-text Encoding

    Wikipedia. (2016, December 26). Binary-to-text encoding. Retrieved March 1, 2017.

    Open source URL
  2. [2]
    Wikipedia Character Encoding

    Wikipedia. (2017, February 19). Character Encoding. Retrieved March 1, 2017.

    Open source URL
  3. [3]
    University of Birmingham C2

    Gardiner, J., Cova, M., Nagaraja, S. (2014, February). Command & Control Understanding, Denying and Detecting. Retrieved April 20, 2016.

    Open source URL
  4. [4]
    mitre-attack T1132.001
    Open source URL
Source and licensing

Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.

Official MITRE ATT&CK site Official STIX data repository MITRE ATT&CK terms of use