T1132.002

Non-Standard Encoding

Command and Control

Adversaries may encode data with a non-standard data encoding system to make the content of command and control traffic more difficult to detect. Non-standard encoding schemes diverge from existing protocol specifications — for example, modified Base64 using a custom alphabet, XOR encoding with a static or rolling key, character substitution (replacing '/' with '-s', '+' with '-p'), or custom binary serialization. Real-world examples include OceanSalt (NOT operation on bytes), Small Sieve (hex byte swapping), TONESHELL (XOR with 32/256-byte key), NightClub (modified Base64 in DNS subdomains), RDAT (Base64 with character substitutions in DNS), InvisiMole (modified Base32 in DNS subdomains), and Uroburos (custom Base62/Base32). Detection focuses on anomalous DNS subdomain lengths and entropy, unusual encoded patterns in network traffic, and scripting processes generating high-entropy outbound data.

Microsoft Sentinel / Defender
kusto 
// Branch 1: DNS tunneling — long or high-cardinality subdomains suggesting encoded data
let DnsTunnelingIndicators =
DeviceNetworkEvents
| where Timestamp > ago(24h)
| where ActionType == "DnsConnectionInspected" or ActionType == "NetworkSignatureInspected"
| where isnotempty(RemoteUrl)
| extend SubdomainParts = split(RemoteUrl, ".")
| extend SubdomainLabel = tostring(SubdomainParts[0])
| where strlen(SubdomainLabel) > 50
| extend HasBase64Chars = SubdomainLabel matches regex @"^[A-Za-z0-9+/=-]{40,}$"
| extend HasModifiedBase64 = SubdomainLabel matches regex @"[A-Za-z0-9_\-]{40,}"
| extend HasHexPattern = SubdomainLabel matches regex @"^[0-9a-fA-F]{40,}$"
| where HasBase64Chars or HasModifiedBase64 or HasHexPattern
| extend EncodingType = case(
    HasHexPattern, "HexEncoded",
    HasBase64Chars, "Base64Like",
    HasModifiedBase64, "ModifiedBase64",
    "Unknown"
  )
| project Timestamp, DeviceName, AccountName, RemoteUrl, SubdomainLabel,
          EncodingType, InitiatingProcessFileName, InitiatingProcessCommandLine;
// Branch 2: DNS queries with anomalous subdomain lengths via Sysmon-style telemetry
let DnsQueryAnomaly =
DeviceNetworkEvents
| where Timestamp > ago(24h)
| where ActionType == "DnsConnectionInspected"
| where isnotempty(RemoteUrl)
| summarize QueryCount=count(), UniqueLabels=dcount(RemoteUrl), MaxLabelLen=max(strlen(RemoteUrl))
    by DeviceName, InitiatingProcessFileName, bin(Timestamp, 10m)
| where QueryCount > 20 and UniqueLabels > 15
| extend Indicator = "HighVolumeDNS_LikelyTunneling";
// Branch 3: HTTP/S connections with encoded path or query strings suggesting custom encoding
let EncodedHttpTraffic =
DeviceNetworkEvents
| where Timestamp > ago(24h)
| where ActionType in ("HttpConnectionInspected", "ConnectionSuccess")
| where isnotempty(RemoteUrl)
| where RemoteUrl matches regex @"/[A-Za-z0-9_\-]{60,}(\?|/|$)"
    or RemoteUrl matches regex @"[?&][a-z]{1,4}=[A-Za-z0-9+/_%\-]{60,}"
| extend UrlLength = strlen(RemoteUrl)
| extend SuspiciousPath = RemoteUrl matches regex @"/[A-Za-z0-9_\-]{60,}"
| extend SuspiciousParam = RemoteUrl matches regex @"[?&][a-z]{1,4}=[A-Za-z0-9+/_%\-]{60,}"
| project Timestamp, DeviceName, AccountName, RemoteUrl, RemoteIP, RemotePort,
          UrlLength, SuspiciousPath, SuspiciousParam,
          InitiatingProcessFileName, InitiatingProcessCommandLine;
// Branch 4: Scripting engines or uncommon processes making repetitive beaconing connections
let BeaconingWithEncoding =
DeviceNetworkEvents
| where Timestamp > ago(24h)
| where InitiatingProcessFileName in~ ("python.exe", "python3", "perl.exe", "ruby.exe",
        "wscript.exe", "cscript.exe", "mshta.exe", "powershell.exe", "pwsh.exe")
| where RemoteIPType == "Public"
| summarize ConnectionCount=count(), UniqueDestinations=dcount(RemoteIP),
            Ports=make_set(RemotePort), BytesSent=sum(SentBytes)
    by DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, bin(Timestamp, 1h)
| where ConnectionCount > 10 and UniqueDestinations < 3
| extend Indicator = "RegularBeaconing_PotentialCustomEncoding";
union DnsTunnelingIndicators, EncodedHttpTraffic
| sort by Timestamp desc
medium severity medium confidence

Data Sources

Network Traffic: Network Traffic Content Network Traffic: Network Connection Creation Network Traffic: Network Traffic Flow Microsoft Defender for Endpoint

Required Tables

DeviceNetworkEvents

False Positives

  • CDN and cloud services that use long, base64-encoded tokens in URLs (AWS S3 presigned URLs, Azure SAS tokens, CloudFront signed URLs)
  • Legitimate DNS-over-HTTPS or DNS security products that may generate high-volume DNS query patterns
  • Monitoring and telemetry agents (Datadog, Dynatrace, New Relic) that POST encoded metrics to collection endpoints using long encoded query strings
  • Single-page applications and web APIs that encode state or session data in URL path components (JWT tokens, serialized objects)
  • Certificate transparency logs and OCSP responders that use base64-encoded certificate data in URLs
Last updated: 2026-04-18 Research depth: deep
References (11)

Unlock Pro Content

Get the full detection package for T1132.002 including response playbook, investigation guide, and atomic red team tests.

Response PlaybookInvestigation GuideHunting QueriesAtomic Red Team TestsTuning Guidance
Sign Up for Pro View Pricing

Related Detections

Parent Technique

T1132Data Encoding

Related Sub-techniques

T1132.001Standard Encoding

Same Tactic: Command and Control

Popular Detections