T1132.002 Non-Standard Encoding
sub-techniqueEnterpriseAdversaries may encode data with a non-standard data encoding system to make the content of command and control traffic more difficult to detect. Command and control (C2) information can be encoded using a non-standard data encoding system that diverges from existing protocol specifications. Non-standard data encoding schemes may be based on or related to standard data encoding schemes, such as a modified Base64 encoding for the message body of an HTTP request.
platforms
Platforms this applies to.
tactics
ATT&CK tactics this technique serves.
sub-technique of
The broader entity this sits under.
mitigations
ATT&CK mitigations that reduce this.
detected by (6)
Data components that detect this.
NIST CSF 2.0 — areas of relevance (Protect / Detect)
NIST CSF 2.0 areas this most relates to (evidence-ranked).
- DE.CMContinuous Monitoringstrong · backed by 5 of 7 mapped controls
- PR.DSData Securitystrong · backed by 4 of 7 mapped controls
- DE.AEAdverse Event Analysismoderate · backed by 2 of 7 mapped controls
Derived from MITRE CTID (Apache-2.0) and the NIST 800-53 ↔ CSF crosswalk (public domain). Indicative relevance along the Protect/Detect axis — not a compliance assessment or coverage claim.
mitigating controls (7)
Security controls that mitigate this.
groups (1)
Threat groups associated with this.
software (17)
Malware and tools associated with this.
source
Where this definition is published.