T1132.001 / ATT&CK

Windows Analytic 0345

Process invokes a standard encoder (e.g., PowerShell -enc, certutil -encode, base64 via.NET/Invoke-Expression) or emits long Base64/hex literals → shortly followed by outbound network egress with high bytes_out:bytes_in ratio or HTTP headers/payloads containing Base64/MIME blocks.

• WinEventLog:Security EventCode=4688
• WinEventLog:Sysmon EventCode=3, 22
• WinEventLog:PowerShell EventCode=4103, 4104, 4105, 4106
• M365Defender:DeviceNetworkEvents NetworkConnection: bytes_sent >> bytes_received anomaly

Linux Analytic 0346

Shell/utility (base64, xxd -p, od, openssl enc -base64, python/perl base64 libraries) encodes data → subsequent outbound connections (curl/wget/bash TCP, socat, python requests) with high asymmetry or Base64/MIME blobs in HTTP/DNS payloads.

• auditd:SYSCALL execve of base64|openssl|xxd|python|perl with arguments matching Base64 flags
• WinEventLog:Sysmon EventCode=3, 22
• NSM:Flow http: HTTP body or headers contain long Base64 sections; gzip/deflate + Base64

macOS Analytic 0347

Processes use base64/xxd/openssl/python Objective‑C APIs to encode data (seen in EndpointSecurity exec events or Unified Logs) → quick outbound connections with large bytes_out or HTTP POSTs carrying Base64/MIME bodies.

• macos:unifiedlog process command line contains base64, -enc, openssl enc -base64
• PF:Logs outbound flows with bytes_out >> bytes_in
• NSM:Flow http: HTTP body contains long Base64 sections

ESXi Analytic 0348

ESXi shell (BusyBox) or VMware utilities (openssl, python if present) used to Base64/hex encode data from datastore or config files → followed by abnormal egress from the host (NSX/flow logs) with asymmetric bytes_out or HTTPS posts to non-management endpoints.

• esxi:shell commands containing base64, openssl enc -base64, xxd -p
• esxi:hostd unexpected script/command invocations via hostd
• NSX:FlowLogs network_flow: bytes_out >> bytes_in to external
• NSM:Flow http: Base64/MIME looking payloads from ESXi host IP