MITRE ATT&CK technique
Data Encoding detection rulesT1132
Data Encoding (T1132) is a MITRE ATT&CK technique in the Command and Control tactic. This page lists the 4 community-maintained Sigma detection rules in the library mapped to T1132 and its sub-techniques. Each rule includes its detection logic, log source, false positives and original YAML. These rules mainly target windows.
Top products
Tactic
DNS Exfiltration and Tunneling Tools Execution
highWell-known DNS Exfiltration tools execution
windows · process_creation
Gzip Archive Decode Via PowerShell
mediumDetects attempts of decoding encoded Gzip archives via PowerShell.
windows · process_creation
Suspicious FromBase64String Usage On Gzip Archive - Process Creation
mediumDetects attempts of decoding a base64 Gzip archive via PowerShell. This technique is often used as a method to load malicious content into memory afterward.
windows · process_creation
Suspicious FromBase64String Usage On Gzip Archive - Ps Script
mediumDetects attempts of decoding a base64 Gzip archive in a PowerShell script. This technique is often used as a method to load malicious content into memory afterward.
windows · ps_script