ATT&CK technique
View on MITRE ATT&CK →
T1132
Data Encoding
Command and Control
8 detections found
Detection rules
| Source | Rule | Status | Updated |
|---|---|---|---|
| elastic | Base16 or Base32 Encoding/Decoding Activity | production | 2026-09-18 |
| suricata | ET MALWARE Outbound POST Request with Base64 ps PowerShell Command Output M2 | rev 3 | 2020-08-28 |
| suricata | ET MALWARE Outbound POST Request with Base64 ps PowerShell Command Output M3 | rev 3 | 2020-08-28 |
| suricata | ET MALWARE Outbound POST Request with Base64 ps PowerShell Command Output M1 | rev 3 | 2020-08-28 |
| snort | ET TROJAN Outbound POST Request with Base64 ps PowerShell Command Output M1 | rev 2 | 2019-04-16 |
| snort | ET TROJAN Outbound POST Request with Base64 ps PowerShell Command Output M2 | rev 2 | 2019-04-16 |
| snort | ET TROJAN Outbound POST Request with Base64 ps PowerShell Command Output M3 | rev 2 | 2019-04-16 |
| sentinel | A host is potentially running PowerShell to send HTTP(S) requests (ASIM Web Session schema) | Scheduled | — |