T1132.001

Official Description

Adversaries may encode data with a standard data encoding system to make the content of command and control traffic more difficult to detect. Command and control (C2) information can be encoded using a standard data encoding system that adheres to existing protocol specifications. Common data encoding schemes include ASCII, Unicode, hexadecimal, Base64, and MIME.(Citation: Wikipedia Binary-to-text Encoding)(Citation: Wikipedia Character Encoding) Some data encoding systems may also result in data compression, such as gzip.

Tactics: Command And Control
Platforms: ESXi, Linux, macOS, Windows
Parent Technique: T1132 · Data Encoding
MITRE Version: 1.1
Last Modified: May 12, 2026

View on MITRE ATT&CK ↗

Reported Context (3)

SloppyRAT Base64-encodes encrypted system information and command results in C2 messages. Zscaler Details SloppyRAT, a New Malware Linked to Ransomware Attacks
The J7Tracker and VREO collector Base64-encodes stolen data before placing it in a collection URL. Malicious Chrome and Firefox Extensions Steal Crypto Traders’ Session and Wallet Data
The beacon base64-encodes results and returns them in 1,500-character chunks. Investigation Details Intrusion Targeting 12 Omani Government Entities, With 26,000 Records Extracted

CVE (4)

Malware (6)

People (1)

Threat Actors (3)

MITRE ATT&CK (50)

Vendors (6)

Products (24)

Tools (4)

Industries (2)

Countries (4)

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.