Data Encoding
- ID
- T1132
- Tactics
- TA0011 Command and Control
- Platforms
- ESXi, Linux, macOS, Windows
- Data sources
- Network Connection Creation, Process Creation, Network Traffic Content, Command Execution, User Account Authentication
- Source
- attack.mitre.org
- MITRE last modified
- 9 Sep 2026
Adversaries may encode data to make the content of command and control traffic more difficult to detect. Command and control (C2) information can be encoded using a standard data encoding system. Use of data encoding may adhere to existing protocol specifications and includes use of ASCII, Unicode, Base64, MIME, or other binary-to-text and character encoding systems.[2][3] Some data encoding systems may also result in data compression, such as gzip.
Sub-techniques (2)
Detection
- DET0108 Detection Strategy for Data Encoding in C2 Channels
Data components: Network Connection Creation, Process Creation, Network Traffic Content, Command Execution, User Account Authentication
Mitigations (1)
- M1031 Network Intrusion Prevention
Network intrusion detection and prevention systems that use network signatures to identify traffic for specific adversary malware can be used to mitigate activity at the network level. Signatures are often for unique indicators within protocols and may be based on the specific obfuscation technique used by a particular adversary or tool, and will likely be different across various malware families and versions. Adversaries will likely change tool C2 signatures over time or construct protocols in such a way as to avoid detection by common defensive tools. [1]
Groups (1)
Software (7)
References
- University of Birmingham C2
- Wikipedia Binary-to-text Encoding
- Wikipedia Character Encoding