Forensia CTI Core

About

Adversaries may encode data with a standard data encoding system to make the content of command and control traffic more difficult to detect. Command and control (C2) information can be encoded using a standard data encoding system that adheres to existing protocol specifications. Common data encoding schemes include ASCII, Unicode, hexadecimal, Base64, and MIME. Some data encoding systems may also result in data compression, such as gzip.

Platforms: ESXi, Linux, macOS, WindowsParent: T1132 Data EncodingMITRE ATT&CK ↗

Used by actors

11 known groups

G0032 Lazarus Group G0034 Sandworm Team G0040 Patchwork G0060 BRONZE BUTLER G0064 APT33 G0069 MuddyWater G0073 APT19 G0081 Tropic Trooper G0125 HAFNIUM G0127 TA551 G1044 APT42

Software

113 malware/tools implement this

BS2005IxesheCarbanakgh0st RATJHUHUGITADVSTORESHELLSeaDukeEliseMisdatMis-TypeS-TypeBackdoor.OldreaPrikormkaPisloaderBADNEWSAutoIt backdoorCORESHELLChChesCobalt StrikeHelminthFelismusPOWRUNERDaserfDipsindPOWERSTATSZebrocyOopsIEKazuarTrickBotBisonalQUADAGENTRogueRobinUPPERCUTMore_eggsRemcosCobian RATOctopusOSX_OCEANLOTUS.DDenisKONNIEmotetAstarothSpeakUpHOPLIGHTEburyRevenge RATnjRATMacheteFysbisBabySharkOkrumPowerShowerRamsayMechaFlounderdown_newValakKesselRDATWellMessBLINDINGCANSparkSUNBURSTStuxnetSideTwistChaesGrimAgentSliverSMOKEDHAMQakBotxCaonSysUpdateDarkWatchmanCharmPowerTorismaFlagproSaint BotKevinDnsSystemCreepySnailMongallSquirrelwafflePingPullSTARWHALEBumblebeeMoriMafaldaQUIETCANARYRotaJakiroSardonicSamuraiPULSECHECKSLIGHTPULSESTEADYPULSEWIREFIREWARPWIREGLASSTOKENGootloaderLunarWebPikabotManjusakaLatrodectusSolarMangoStrelaStealerKapekaTAMECATTroll StealerGomirLockBit 3.0RedLine StealerBRICKSTORMPHPsertRustyWater

Corpus indicators tagged with this technique

752 indicators in the corpus carry T1132.001.

Indicator	Type	Family	Sev	Src
a2c6e01001c62f6198e31a9d603977c6	hash	—	80	2
9e5b1e10ad6904d3f5b48d38470cd57263974640a27d13cf793ef026d3d6b886	hash	—	80	2
f8cbe44fde6914bc8d06426c03c92ed536c891470292e567a586b54af29c2442	hash	—	80	2
b8b8d41a8a7eccda90b366fb5a3d2c0f692504984429aaa19b0af0dcd81dec03	hash	—	80	2
91e523a46f3bb860ac2e5800b7e1ec89d75a2408410b9cd25eebc17c8d7a92bc	hash	—	80	2
99813f3d0625e880158c68039c0e2fbf488db0be3db77cd1ce6d382644193f0e	hash	—	80	2
bbcc1a208b4bd0a9ffe8799158cd994d82e125acb30b630e774b242f11dd6985	hash	—	80	2
fab69acd743f4111b749e3268690825c38822e62	hash	—	80	2
a29cdca72822c1f236c53c181d03f0c45907a45f2ef3c4c2da3ef839bfd3b7a6	hash	—	80	2
af93524fd0aac0a790734a0747fcf844ba5f0652b11a0f4a59bbe5aeace0fa75	hash	—	80	2
1a92cf241f86584361097d5735948a8170007206db56fe88739c9048767ab862	hash	—	80	2
44f6101dd8171133f53317bfd752300e	hash	—	80	2
d06b86da3777be0e2156c35f031f503d280a17ee3a1cc531f4c5fb806c0f749b	hash	—	80	2
ca5fd64932a82d3e24a19fe94d8b7636847f4335b8fd8795a63cfa0107e67048	hash	—	80	2
2e04dc8bee038a5771373fc4dbaa4e45f653cd649928199e9ce8098c8b27d64e	hash	—	80	2
22c860931f2ed22897b81ef8da16980fc24b2573ec884a153b3ff5df9e0f8cff	hash	—	80	2
51ead7f0490bfe6b432120bbbd63b807277d016911664fb264640bb8b007d756	hash	—	80	2
69f524815eeb3b2069ff41a8a12cae0537de8ad9bd856d694fa21bb2af8fada8	hash	—	80	2
79aec671ceb205db1769da6898c9659c7c8297b13929e593050523438c09a44f	hash	—	80	2
7b7981c99d59595fe15377df84695bb72ce0b85560a3935f930657b2d162e5ef	sha256	phishing	80	1
a806cece4a4fbbe502e6d76035681702d9adde1c6f74c9e1c0547d37d30ddfcf	hash	—	80	2
adcd15f3d6b87f84d106ea426fa824fd20c9d64f6d199ce92580884290785f30	sha256	phishing	80	1
d7d2f0ee187549f3f4a114d716be12521fbf62d6d26e2ac23d2a32d521d08fd8	sha256	phishing	80	1
2a6f0837007726a1863f2180a9a84a89284dc57e7557857e2a3d1896a69fe6c7	hash	—	80	2
3a69aedb78677993384dfe9b476e3d26	hash	—	80	2
2227df1207d2c90db46610bd98909032	hash	—	80	2
bf0b36dcbbc60dbf83ecac7c56534271e53a16817909306ecc6f15f7b6106730	hash	—	80	2
55c0235188c16bd2e18a21fa78d9a39c220b8b73	hash	—	80	2
0a14b993fdac34f7a05b6d9d22f5fa9cfc711134	hash	—	80	2
6328567511d88fdc2ae0939c5ef17b7a63d2a833881900de018a4f12f4982525	sha256	prompt_injection	80	2

Showing the top 30 by severity of 752.