Use intrusion detection signatures to block traffic at network boundaries.
MITRE mitigation sourceAdversaryGraph public intelligence page
This page is part of Threat Matrix, the public browser workspace for the main AdversaryGraph platform. Use it for ATT&CK pivots, actor and technique context, similarity leads, detection coverage review, and analyst-ready investigation paths.
Validation disclaimer: TTP overlap, actor similarity, generated summaries, and coverage findings are investigation leads, not attribution proof or operational validation without analyst review.
Main AdversaryGraph project Documentation Malware Analysis GitHub
Data Encoding
Adversaries may encode data to make the content of command and control traffic more difficult to detect. Command and control (C2) information can be encoded using a standard data encoding system. Use of data encoding may adhere to existing protocol specifications and includes use of ASCII, Unicode, Base64, MIME, or other binary-to-text and character encoding systems. Some data encoding systems may also result in data compression, such as gzip.
Open detection, hunting, mitigation, and evidence workspace
Detection logic
Analyze network data for uncommon data flows (e.g., a client sending significantly more data than it receives from a server). Processes utilizing the network that do not normally have network communication or have never been seen before are suspicious. Analyze packet contents to detect communications that do not follow the expected protocol behavior for the port that is being used.
Observed actors
Correlated CTI and IR reports
ATT&CK as a Working Tool: Theory and Hands-On Practical Usage
1200km CTI repository · explicit report mentionOilRig (APT34 / Helix Kitten / Earth Simnavaz etc)
Israel Threat Actors CTI · explicit report mentionATT CK as a Working Tool Theory and Hands On Practical Usage
1200km Medium · authored report mention
1200km CTI repository · explicit report mentionOilRig (APT34 / Helix Kitten / Earth Simnavaz etc)
Israel Threat Actors CTI · explicit report mentionATT CK as a Working Tool Theory and Hands On Practical Usage
1200km Medium · authored report mention
Cyber Knowledge context
Use these routes to move from the ATT&CK behavior into explanation, implementation, evidence handling, validation, and defensive operations. Relevance is generated from explicit identifiers/names and governed topic mappings; it is not attribution evidence.
File identity, containers, and executable formats
Malware Analysis & Reverse Engineering · Governed topic match · 51/100Scripts, documents, shortcuts, and fileless chains
Malware Analysis & Reverse Engineering · Governed topic match · 51/100Module 6 — The Threat Actor Landscape
Cyber Threat Intelligence (CTI) · Tactic learning route · 24/100Disassembly, decompilation, and code-led analysis
Malware Analysis & Reverse Engineering · Tactic learning route · 24/100Module 5 — Threat hunting
Blue Team & Defensive Security · Tactic learning route · 24/100
Malware Analysis & Reverse Engineering · Governed topic match · 51/100Scripts, documents, shortcuts, and fileless chains
Malware Analysis & Reverse Engineering · Governed topic match · 51/100Module 6 — The Threat Actor Landscape
Cyber Threat Intelligence (CTI) · Tactic learning route · 24/100Disassembly, decompilation, and code-led analysis
Malware Analysis & Reverse Engineering · Tactic learning route · 24/100Module 5 — Threat hunting
Blue Team & Defensive Security · Tactic learning route · 24/100
MITRE mitigations
MITRE detection strategies and analytics
- AN0302 · Analytic 0302 — Atypical processes (e.g., powershell.exe, regsvr32.exe) encode large outbound traffic using Base64 or other character encodings; this traffic is sent over uncommon ports or embedded in protocol fields (e.g., HTTP cookies or headers).
- AN0303 · Analytic 0303 — Custom scripts or processes encode outbound traffic using gzip, Base64, or hex prior to exfiltration via curl, wget, or custom sockets. Encoding typically occurs before or during outbound connections from non-network daemons.
- AN0304 · Analytic 0304 — Processes use built-in encoding utilities (e.g., `base64`, `xxd`, or `plutil`) to encode file contents followed by HTTP/HTTPS transfer via curl or custom applications.
- AN0305 · Analytic 0305 — ESXi daemons (e.g., hostd, vpxa) are wrapped or impersonated to send large outbound traffic using gzip/Base64 encoding over SSH or HTTP. These actions follow suspicious logins or shell access.