T1132 · Data Encoding

Sunturai

Detections can measure how the public catalogue is used — which detections people look for, and which pages bring them here. It sets a cookie that recognises this browser for 180 days. It is never linked to an account and never follows you to other sites. Privacy notice

T1132 · Data Encoding · Sunturai

attack-patternenterprise-attackT1132

Data Encoding

attack-pattern--cc7b8c4e-9be0-47ca-b0bb-83915ec3ee2f

Adversaries may encode data to make the content of command and control traffic more difficult to detect. Command and control (C2) information can be encoded using a standard data encoding system. Use of data encoding may adhere to existing protocol specifications and includes use of ASCII, Unicode, Base64, MIME, or other binary-to-text and character encoding systems.(Citation: Wikipedia Binary-to-text Encoding) (Citation: Wikipedia Character Encoding) Some data encoding systems may also result in data compression, such as gzip.

Created: May 31, 2017, 9:31 PM UTC
Modified: May 12, 2026, 3:12 PM UTC

2 sub-techniques under this technique

Each is its own technique in the catalogue, with its own detections.

4 published detections cover this technique

Every one carries the source it came from and the licence it was published under.

Detections covering this technique
Detection	Severity	Source	Published	Licence
Base16 or Base32 Encoding/Decoding Activity	Medium	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
Cisco Cloud Security - Windows PowerShell User-Agent Detected	Medium	—	Sep 4, 2026	MIT License
A host is potentially running PowerShell to send HTTP(S) requests (ASIM Web Session schema)	Medium	Microsoft Sentinel analytics	Sep 2, 2026	MIT License
Excessive Blocked Traffic Events Generated by User	Medium	Microsoft Sentinel analytics	Sep 1, 2026	MIT License

Showing 4 of 4

Filter in the catalogue

External references

mitre-attackT1132Open reference

University of Birmingham C2Open reference

Wikipedia Binary-to-text EncodingOpen reference

Wikipedia Character EncodingOpen reference

Platforms

ESXiLinuxmacOSWindows

Kill chain phases

command-and-control

Relationships

Incoming and outgoing edges in the selected ATT&CK release.

Incoming and outgoing edges in the selected ATT&CK release
Direction	Type	Related object