T1132 / ATT&CK

Windows Analytic 0302

Atypical processes (e.g., powershell.exe, regsvr32.exe) encode large outbound traffic using Base64 or other character encodings; this traffic is sent over uncommon ports or embedded in protocol fields (e.g., HTTP cookies or headers).

• WinEventLog:Sysmon EventCode=3, 22
• WinEventLog:Sysmon EventCode=1
• NSM:Flow Unusual Base64-encoded content in URI, headers, or POST body

Linux Analytic 0303

Custom scripts or processes encode outbound traffic using gzip, Base64, or hex prior to exfiltration via curl, wget, or custom sockets. Encoding typically occurs before or during outbound connections from non-network daemons.

• auditd:SYSCALL execve
• NSM:Flow Base64 strings or gzip in URI, headers, or POST body
• linux:syslog Unusual outbound transfers from CLI tools like base64, gzip, or netcat

macOS Analytic 0304

Processes use built-in encoding utilities (e.g., `base64`, `xxd`, or `plutil`) to encode file contents followed by HTTP/HTTPS transfer via curl or custom applications.

• macos:unifiedlog base64 or curl processes chained within short execution window
• macos:unifiedlog HTTP POST with encoded content in user-agent or cookie field

ESXi Analytic 0305

ESXi daemons (e.g., hostd, vpxa) are wrapped or impersonated to send large outbound traffic using gzip/Base64 encoding over SSH or HTTP. These actions follow suspicious logins or shell access.

• esxi:shell base64 or gzip use within shell session
• esxi:vmkernel Outbound traffic using encoded payloads post-login
• ESXiLogs:authlog Unexpected login followed by encoding commands