MITRE ATT&CK - Техника Стандартное кодирование

Куда я попал?

SECURITM это SGRC система, автоматизирующая процессы в службах информационной безопасности. SECURITM помогает построить и управлять ИСПДн, КИИ, ГИС, СМИБ/СУИБ, банковскими системами защиты.
А еще SECURITM это место для обмена опытом и наработками для служб безопасности.

Подробнее

Наш канал

Data Encoding: Стандартное кодирование

Other sub-techniques of Data Encoding (2)

ID	Название
.001	Стандартное кодирование
.002	Нестандартное кодирование

Adversaries may encode data with a standard data encoding system to make the content of command and control traffic more difficult to detect. Command and control (C2) information can be encoded using a standard data encoding system that adheres to existing protocol specifications. Common data encoding schemes include ASCII, Unicode, hexadecimal, Base64, and MIME.(Citation: Wikipedia Binary-to-text Encoding) (Citation: Wikipedia Character Encoding) Some data encoding systems may also result in data compression, such as gzip.

ID: T1132.001

Относится к технике: T1132

Тактика(-и): Command and Control

Платформы: Linux, macOS, Windows

Требуемые разрешения: User

Источники данных: Network Traffic: Network Traffic Content

Версия: 1.0

Дата создания: 14 Mar 2020

Последнее изменение: 14 Mar 2020

Название	Описание
Примеры процедур
SideTwist	SideTwist has used Base64 for encoded C2 traffic.(Citation: Check Point APT34 April 2021)
Fysbis	Fysbis can use Base64 to encode its C2 traffic.(Citation: Fysbis Dr Web Analysis)
DnsSystem	DnsSystem can Base64 encode data sent to C2.(Citation: Zscaler Lyceum DnsSystem June 2022)
ADVSTORESHELL	C2 traffic from ADVSTORESHELL is encrypted, then encoded with Base64 encoding.(Citation: Kaspersky Sofacy)
Flagpro	Flagpro has encoded bidirectional data communications between a target system and C2 server using Base64.(Citation: NTT Security Flagpro new December 2021)
Stuxnet	Stuxnet transforms encrypted binary data into an ASCII string in order to use it as a URL parameter value.(Citation: Symantec W.32 Stuxnet Dossier)
SeaDuke	SeaDuke C2 traffic is base64-encoded.(Citation: Unit 42 SeaDuke 2015)
Sandworm Team	Sandworm Team's BCS-server tool uses base64 encoding and HTML tags for the communication traffic between the C2 server.(Citation: ESET Telebots Dec 2016)
Chaes	Chaes has used Base64 to encode C2 communications.(Citation: Cybereason Chaes Nov 2020)
Kevin	Kevin can Base32 encode chunks of output files during exfiltration.(Citation: Kaspersky Lyceum October 2021)
down_new	down_new has the ability to base64 encode C2 communications.(Citation: Trend Micro Tick November 2019)
Patchwork	Patchwork used Base64 to encode C2 traffic.(Citation: Cymmetria Patchwork)
Torisma	Torisma has encoded C2 communications with Base64.(Citation: McAfee Lazarus Nov 2020)
JHUHUGIT	A JHUHUGIT variant encodes C2 POST data base64.(Citation: Unit 42 Playbook Dec 2017)
SUNBURST	SUNBURST used Base64 encoding in its C2 traffic.(Citation: FireEye SUNBURST Backdoor December 2020)
SMOKEDHAM	SMOKEDHAM has encoded its C2 traffic with Base64.(Citation: FireEye SMOKEDHAM June 2021)
CORESHELL	CORESHELL C2 messages are Base64-encoded.(Citation: FireEye APT28)
QUADAGENT	QUADAGENT encodes C2 communications with base64.(Citation: Unit 42 QUADAGENT July 2018)
Astaroth	Astaroth encodes data using Base64 before sending it to the C2 server. (Citation: Cofense Astaroth Sept 2018)
ChChes	ChChes can encode C2 data with a custom technique that utilizes Base64.(Citation: Palo Alto menuPass Feb 2017)(Citation: JPCERT ChChes Feb 2017)
BLINDINGCAN	BLINDINGCAN has encoded its C2 traffic with Base64.(Citation: US-CERT BLINDINGCAN Aug 2020)
Octopus	Octopus has encoded C2 communications in Base64.(Citation: Securelist Octopus Oct 2018)
Daserf	Daserf uses custom base64 encoding to obfuscate HTTP traffic.(Citation: Secureworks BRONZE BUTLER Oct 2017)
RDAT	RDAT can communicate with the C2 via base32-encoded subdomains.(Citation: Unit42 RDAT July 2020)
Pisloader	Responses from the Pisloader C2 server are base32-encoded.(Citation: Palo Alto DNS Requests)
GrimAgent	GrimAgent can base64 encode C2 replies.(Citation: Group IB GrimAgent July 2021)
BRONZE BUTLER	Several BRONZE BUTLER tools encode data with base64 when posting it to a C2 server.(Citation: Secureworks BRONZE BUTLER Oct 2017)
Spark	Spark has encoded communications with the C2 server with base64.(Citation: Unit42 Molerat Mar 2020)
MechaFlounder	MechaFlounder has the ability to use base16 encoded strings in C2.(Citation: Unit 42 MechaFlounder March 2019)
Denis	Denis encodes the data sent to the server in Base64.(Citation: Cybereason Cobalt Kitty 2017)
OopsIE	OopsIE encodes data in hexadecimal format over the C2 channel.(Citation: Unit 42 OopsIE! Feb 2018)
Kazuar	Kazuar encodes communications to the C2 server in Base64.(Citation: Unit 42 Kazuar May 2017)
Machete	Machete has used base64 encoding.(Citation: Securelist Machete Aug 2014)
PingPull	PingPull can encode C2 traffic with Base64.(Citation: Unit 42 PingPull Jun 2022)
TA551	TA551 has used encoded ASCII text for initial C2 communications.(Citation: Unit 42 Valak July 2020)
Revenge RAT	Revenge RAT uses Base64 to encode information sent to the C2 server.(Citation: Cylance Shaheen Nov 2018)
POWERSTATS	POWERSTATS encoded C2 traffic with base64.(Citation: Unit 42 MuddyWater Nov 2017)
Backdoor.Oldrea	Some Backdoor.Oldrea samples use standard Base64 + bzip2, and some use standard Base64 + reverse XOR + RSA-2048 to decrypt data received from C2 servers.(Citation: Symantec Dragonfly)
HOPLIGHT	HOPLIGHT has utilized Zlib compression to obfuscate the communications payload. (Citation: US-CERT HOPLIGHT Apr 2019)
Okrum	Okrum has used base64 to encode C2 communication.(Citation: ESET Okrum July 2019)
Squirrelwaffle	Squirrelwaffle has encoded its communications to C2 servers using Base64.(Citation: ZScaler Squirrelwaffle Sep 2021)
BADNEWS	BADNEWS encodes C2 traffic with base64.(Citation: Forcepoint Monsoon)(Citation: PaloAlto Patchwork Mar 2018)(Citation: TrendMicro Patchwork Dec 2017)
Bumblebee	Bumblebee has the ability to base64 encode C2 server responses.(Citation: Proofpoint Bumblebee April 2022)
njRAT	njRAT uses Base64 encoding for C2 traffic.(Citation: Fidelis njRAT June 2013)
TrickBot	TrickBot can Base64-encode C2 commands.(Citation: Cyberreason Anchor December 2019)
Mis-Type	Mis-Type uses Base64 encoding for C2 traffic.(Citation: Cylance Dust Storm)
AutoIt backdoor	AutoIt backdoor has sent a C2 response that was base64-encoded.(Citation: Forcepoint Monsoon)
S-Type	S-Type uses Base64 encoding for C2 traffic.(Citation: Cylance Dust Storm)
Lazarus Group	A Lazarus Group malware sample encodes data with base64.(Citation: McAfee Lazarus Resurfaces Feb 2018)
DarkWatchman	DarkWatchman encodes data using hexadecimal representation before sending it to the C2 server.(Citation: Prevailion DarkWatchman 2021)
Dipsind	Dipsind encodes C2 traffic with base64.(Citation: Microsoft PLATINUM April 2016)
RogueRobin	RogueRobin base64 encodes strings that are sent to the C2 over its DNS tunnel.(Citation: Unit 42 DarkHydrus July 2018)
WellMess	WellMess has used Base64 encoding to uniquely identify communication to and from the C2.(Citation: CISA WellMess July 2020)
Kessel	Kessel has exfiltrated data via hexadecimal-encoded subdomain fields of DNS queries.(Citation: ESET ForSSHe December 2018)
Tropic Trooper	Tropic Trooper has used base64 encoding to hide command strings delivered from the C2.(Citation: TrendMicro Tropic Trooper May 2020)
BabyShark	BabyShark has encoded data using certutil before exfiltration.(Citation: Unit42 BabyShark Feb 2019)
Ixeshe	Ixeshe uses custom Base64 encoding schemes to obfuscate command and control traffic in the message body of HTTP requests.(Citation: Moran 2013)(Citation: Trend Micro IXESHE 2012)
CreepySnail	CreepySnail can use Base64 to encode its C2 traffic.(Citation: Microsoft POLONIUM June 2022)
PowerShower	PowerShower has the ability to encode C2 communications with base64 encoding.(Citation: Unit 42 Inception November 2018)(Citation: Kaspersky Cloud Atlas August 2019)
Prikormka	Prikormka encodes C2 traffic with Base64.(Citation: ESET Operation Groundbait)
KONNI	KONNI has used a custom base64 key to encode stolen data before exfiltration.(Citation: Medium KONNI Jan 2020)
Bisonal	Bisonal has encoded binary data with Base64 and ASCII.(Citation: Kaspersky CactusPete Aug 2020)(Citation: Talos Bisonal Mar 2020)
Misdat	Misdat network traffic is Base64-encoded plaintext.(Citation: Cylance Dust Storm)
MuddyWater	MuddyWater has used tools to encode C2 communications including Base64 encoding.(Citation: ClearSky MuddyWater June 2019)(Citation: Trend Micro Muddy Water March 2021)
Cobian RAT	Cobian RAT obfuscates communications with the C2 server using Base64 encoding.(Citation: Zscaler Cobian Aug 2017)
BS2005	BS2005 uses Base64 encoding for communication in the message body of an HTTP request.(Citation: Mandiant Operation Ke3chang November 2014)
Mongall	Mongall can use Base64 to encode information sent to its C2.(Citation: SentinelOne Aoqin Dragon June 2022)
More_eggs	More_eggs has used basE91 encoding, along with encryption, for C2 communication.(Citation: Security Intelligence More Eggs Aug 2019)
xCaon	xCaon has used Base64 to encode its C2 traffic.(Citation: Checkpoint IndigoZebra July 2021)
POWRUNER	POWRUNER can use base64 encoded C2 communications.(Citation: FireEye APT34 Dec 2017)
Felismus	Some Felismus samples use a custom method for C2 traffic that utilizes Base64.(Citation: Forcepoint Felismus Mar 2017)
Valak	Valak has returned C2 data as encoded ASCII.(Citation: Unit 42 Valak July 2020)
SpeakUp	SpeakUp encodes C&C communication using Base64. (Citation: CheckPoint SpeakUp Feb 2019)
Mori	Mori can use Base64 encoded JSON libraries used in C2.(Citation: DHS CISA AA22-055A MuddyWater February 2022)
Ebury	Ebury has encoded C2 traffic in hexadecimal format.(Citation: ESET Ebury Feb 2014)
gh0st RAT	gh0st RAT has used Zlib to compress C2 communications data before encrypting it.(Citation: Gh0stRAT ATT March 2019)
Elise	Elise exfiltrates data using cookie values that are Base64-encoded.(Citation: Lotus Blossom Jun 2015)
Cobalt Strike	Cobalt Strike can use Base64, URL-safe Base64, or NetBIOS encoding in its C2 traffic.(Citation: Cobalt Strike Manual 4.3 November 2020)
APT19	An APT19 HTTP malware variant used Base64 to encode communications to the C2 server.(Citation: Unit 42 C0d0so0 Jan 2016)
QakBot	QakBot can Base64 encode system information sent to C2.(Citation: Crowdstrike Qakbot October 2020)(Citation: Kaspersky QakBot September 2021)
Zebrocy	Zebrocy has used URL/Percent Encoding on data exfiltrated via HTTP POST requests.(Citation: Accenture SNAKEMACKEREL Nov 2018)
Carbanak	Carbanak encodes the message body of HTTP traffic with Base64.(Citation: Kaspersky Carbanak)(Citation: FireEye CARBANAK June 2017)
Sliver	Sliver can use standard encoding techniques like gzip and hex to ASCII to encode the C2 communication payload.(Citation: GitHub Sliver HTTP)
APT33	APT33 has used base64 to encode command and control traffic.(Citation: FireEye APT33 Guardrail)
STARWHALE	STARWHALE has the ability to hex-encode collected data from an infected host.(Citation: DHS CISA AA22-055A MuddyWater February 2022)
CharmPower	CharmPower can send additional modules over C2 encoded with base64.(Citation: Check Point APT35 CharmPower January 2022)
Helminth	For C2 over HTTP, Helminth encodes data with base64 and sends it via the "Cookie" field of HTTP requests. For C2 over DNS, Helminth converts ASCII characters into their hexadecimal values and sends the data in cleartext.(Citation: Palo Alto OilRig May 2016)
Saint Bot	Saint Bot has used Base64 to encode its C2 communications.(Citation: Malwarebytes Saint Bot April 2021)
Ramsay	Ramsay has used base64 to encode its C2 traffic.(Citation: Antiy CERT Ramsay April 2020)
HAFNIUM	HAFNIUM has used ASCII encoding for C2 traffic.(Citation: Microsoft HAFNIUM March 2020)

Контрмера	Описание
Контрмеры
Network Intrusion Prevention	Use intrusion detection signatures to block traffic at network boundaries.

Обнаружение

Analyze network data for uncommon data flows (e.g., a client sending significantly more data than it receives from a server). Processes utilizing the network that do not normally have network communication or have never been seen before are suspicious. Analyze packet contents to detect communications that do not follow the expected protocol behavior for the port that is being used.(Citation: University of Birmingham C2)

Ссылки

Связанные риски

Ничего не найдено

Каталоги

Мы используем cookie-файлы, чтобы получить статистику, которая помогает нам улучшить сервис для вас с целью персонализации сервисов и предложений. Вы может прочитать подробнее о cookie-файлах или изменить настройки браузера. Продолжая пользоваться сайтом, вы даёте согласие на использование ваших cookie-файлов и соглашаетесь с Политикой обработки персональных данных.