Clankerusecase
MITRE ATT&CK detection coverage
 ← Back to main site
Home/ MITRE Matrix/ Command and Control/ T1132.001

T1132.001Standard Encoding

T1132.001 — Standard Encoding is a MITRE ATT&CK technique in the Command and Control tactic. Clankerusecase tracks 8 detection use cases covering it and 10 threat-intel articles citing it.

Command and Control
View on the matrix → Filter Detection Library MITRE official spec ↗
8Use cases
10Articles
0Sub-techniques
1Tactic
↑ Parent technique: T1132 · Data Encoding

Use cases covering this technique (8)

[LLM] Improvised C2 over public request-capture / pastebin / file-drop services from server infra Bespoke c2 · hunting DSΣCS [LLM] CAV3RN/HOLLOWGRAPH DNS AAAA config-recovery beaconing to cloudlanecdn[.]com Bespoke c2 · alerting DSΣPCS [LLM] Starland RAT / WLDR C2 beaconing to UAT-11795 HWID-parameterized domains Bespoke c2 · alerting DSΣPDDCS [LLM] Injective SDK wallet-key exfil to lookalike domain testnet.archival.chain.grpc-web.injective.network Bespoke actions · alerting DSΣPDDCS [LLM] Exfil to lookalike Injective gRPC-web subdomain (@injectivelabs stealer C2) Bespoke c2 · alerting DSΣPDDCS [LLM] C2 egress to flipboxstudio.info from Laravel-Lang composer dropper Bespoke c2 · alerting DSΣPDDCS [LLM] Scavenger npm malware C2 beacon to firebase.su / dieorsuffer.com / smartscreen-api.com Bespoke c2 · alerting DSΣPDD [LLM] MuddyViper C2 fingerprint: 'A WinHTTP Example Program/1.0' UA + distinctive URI paths Bespoke c2 · alerting DSΣPDDCS

Articles citing this technique (10)

crit OpenAI Agent Used Exposed Credentials Across Four Services During Hugging Face Breach art-27
high New Project CAV3RN module abuses Outlook calendar events for C2 and DNS AAAA records for configuration recovery art-132
crit UAT-11795 deploys novel Starland RAT and bespoke WLDR C2 implant in financially motivated campaign art-156
high Injective npm Supply Chain Attack: 18 Packages Backdoored to Steal Crypto Wallet Keys art-196
crit Compromised @injectivelabs/sdk-ts exfiltrates wallet keys through fake telemetry art-215
crit ESET takes part in Operation Endgame to disrupt Amadey and Stealc art-301
high Supply Chain Attack Targets Laravel-Lang Packages with Credential Stealer art-400
crit Webworm: New burrowing techniques art-413
crit Another npm Supply Chain Attack: The 'is' Package Compromise art-654
med MuddyWater: Snakes by the riverbank art-756