Adversaries may encode data with a standard data encoding system to make the content of command and control traffic more difficult to detect. Command and control (C2) information can be encoded using a standard data encoding system that adheres to existing protocol specifications. Common data encoding schemes include ASCII, Unicode, hexadecimal, Base64, and MIME. Some data encoding systems may also result in data compression, such as gzip.
C2 traffic from ADVSTORESHELL is encrypted, then encoded with Base64 encoding.
An APT19 HTTP malware variant used Base64 to encode communications to the C2 server.
APT33 has used base64 to encode command and control traffic.
Astaroth encodes data using Base64 before sending it to the C2 server. 
AutoIt backdoor has sent a C2 response that was base64-encoded.
BabyShark has encoded data using certutil before exfiltration.
Some Backdoor.Oldrea samples use standard Base64 + bzip2, and some use standard Base64 + reverse XOR + RSA-2048 to decrypt data received from C2 servers.
Bisonal has encoded binary data with Base64 and ASCII.
BLINDINGCAN has encoded its C2 traffic with Base64.
Several BRONZE BUTLER tools encode data with base64 when posting it to a C2 server.
BS2005 uses Base64 encoding for communication in the message body of an HTTP request.
Bumblebee has the ability to base64 encode C2 server responses.
Carbanak encodes the message body of HTTP traffic with Base64.
CharmPower can send additional modules over C2 encoded with base64.
ChChes can encode C2 data with a custom technique that utilizes Base64.
Cobalt Strike can use Base64, URL-safe Base64, or NetBIOS encoding in its C2 traffic.
Cobian RAT obfuscates communications with the C2 server using Base64 encoding.
CreepySnail can use Base64 to encode its C2 traffic.
DarkWatchman encodes data using hexadecimal representation before sending it to the C2 server.
Daserf uses custom base64 encoding to obfuscate HTTP traffic.
down_new has the ability to base64 encode C2 communications.
Elise exfiltrates data using cookie values that are Base64-encoded.
Some Felismus samples use a custom method for C2 traffic that utilizes Base64.
Flagpro has encoded bidirectional data communications between a target system and C2 server using Base64.
gh0st RAT has used Zlib to compress C2 communications data before encrypting it.
For C2 over HTTP, Helminth encodes data with base64 and sends it via the "Cookie" field of HTTP requests. For C2 over DNS, Helminth converts ASCII characters into their hexadecimal values and sends the data in cleartext.
HOPLIGHT has utilized Zlib compression to obfuscate the communications payload. 
Ixeshe uses custom Base64 encoding schemes to obfuscate command and control traffic in the message body of HTTP requests.
Kazuar encodes communications to the C2 server in Base64.
Kessel has exfiltrated data via hexadecimal-encoded subdomain fields of DNS queries.
Kevin can Base32 encode chunks of output files during exfiltration.
KONNI has used a custom base64 key to encode stolen data before exfiltration.
A Lazarus Group malware sample encodes data with base64.
Mafalda can encode data using Base64 prior to exfiltration.
MechaFlounder has the ability to use base16 encoded strings in C2.
Mongall can use Base64 to encode information sent to its C2.
More_eggs has used basE91 encoding, along with encryption, for C2 communication.
MuddyWater has used tools to encode C2 communications including Base64 encoding.
OopsIE encodes data in hexadecimal format over the C2 channel.
Responses from the Pisloader C2 server are base32-encoded.
PowerShower has the ability to encode C2 communications with base64 encoding.
POWERSTATS encoded C2 traffic with base64.
QakBot can Base64 encode system information sent to C2.
RDAT can communicate with the C2 via base32-encoded subdomains.
Revenge RAT uses Base64 to encode information sent to the C2 server.
RogueRobin base64 encodes strings that are sent to the C2 over its DNS tunnel.
Saint Bot has used Base64 to encode its C2 communications.
Sandworm Team's BCS-server tool uses base64 encoding and HTML tags for the communication traffic between the C2 server.
Sliver can use standard encoding techniques like gzip and hex to ASCII to encode the C2 communication payload.
Spark has encoded communications with the C2 server with base64.
Squirrelwaffle has encoded its communications to C2 servers using Base64.
STARWHALE has the ability to hex-encode collected data from an infected host.
Stuxnet transforms encrypted binary data into an ASCII string in order to use it as a URL parameter value.
TA551 has used encoded ASCII text for initial C2 communications.
Tropic Trooper has used base64 encoding to hide command strings delivered from the C2.
WellMess has used Base64 encoding to uniquely identify communication to and from the C2.
Zebrocy has used URL/Percent Encoding on data exfiltrated via HTTP POST requests.
|M1031||Network Intrusion Prevention||
Network intrusion detection and prevention systems that use network signatures to identify traffic for specific adversary malware can be used to mitigate activity at the network level. Signatures are often for unique indicators within protocols and may be based on the specific obfuscation technique used by a particular adversary or tool, and will likely be different across various malware families and versions. Adversaries will likely change tool C2 signatures over time or construct protocols in such a way as to avoid detection by common defensive tools.
|ID||Data Source||Data Component||Detects|
|DS0029||Network Traffic||Network Traffic Content||
Monitor for network data for uncommon data flows (e.g., a client sending significantly more data than it receives from a server). Processes utilizing the network that do not normally have network communication or have never been seen before are suspicious. Analyze packet contents to detect communications that do not follow the expected protocol behavior for the port that is being used.