Non-Standard Encoding
Subtechnique · ATTACK:enterprise:T1132.002
Attributed source ↗ · Plaintext record · Complete record and assertions JSON
Inspect structured metadata and provenance
{
"id": "ATTACK:enterprise:T1132.002",
"title": "Non-Standard Encoding",
"type": "Subtechnique",
"source_url": "https://attack.mitre.org/techniques/T1132/002",
"snapshot": "enterprise-attack-20.0.json",
"status": "active",
"rights": "Source metadata only; source notices retained; no operational prose or payloads",
"review_status": "machine-extracted; source-specific checks passed, editorial review pending",
"stix_id": "attack-pattern--d467bc38-284b-4a00-96ac-125f447799fc",
"external_id": "T1132.002",
"domain": "enterprise",
"created": "2020-03-14T23:39:50.117Z",
"modified": "2026-05-12T15:12:00.717Z",
"version": "1.1",
"aliases": [
],
"tactics": [
"command-and-control"
],
"source_references": [
{
"source_name": "Wikipedia Binary-to-text Encoding",
"url": "https://en.wikipedia.org/wiki/Binary-to-text_encoding"
},
{
"source_name": "Wikipedia Character Encoding",
"url": "https://en.wikipedia.org/wiki/Character_encoding"
}
]
}Explicit source assertions (20)
First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.
ATTACK:enterprise:S0346 → uses → ATTACK:enterprise:T1132.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--1dac9ffa-1523-4cab-b28f-2d5642ee08aa
McAfee Oceansalt Oct 2018ATTACK:enterprise:S1035 → uses → ATTACK:enterprise:T1132.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--361df799-64ee-405f-bd31-788ecc5c8d45
DHS CISA AA22-055A MuddyWater February 2022 · NCSC GCHQ Small Sieve Jan 2022ATTACK:enterprise:S1239 → uses → ATTACK:enterprise:T1132.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--483a975b-6d40-439f-9fcf-f65cf6225828
2025_IBM_PUBLOAD_TONESHELL_HIUPAN_CLAIMLOADER_MUSTANG PANDA · 2022 November_TrendMicro_Earth Preta_Toneshell_PubloadATTACK:enterprise:T1132.002 → subtechnique-of → ATTACK:enterprise:T1132
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--48f191ab-6e27-44cd-9de6-a0e06e58d983
ATTACK:enterprise:S1090 → uses → ATTACK:enterprise:T1132.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--5da3452c-3f93-42f0-98fd-54fa7bc0c562
MoustachedBouncer ESET August 2023ATTACK:enterprise:S0495 → uses → ATTACK:enterprise:T1132.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--5ef6ff08-0567-4366-a1df-13184c460cc4
Unit42 RDAT July 2020ATTACK:enterprise:S0260 → uses → ATTACK:enterprise:T1132.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--657cb17c-b227-4f97-a19a-e1b0fb7c839d
ESET InvisiMole June 2020ATTACK:enterprise:S0022 → uses → ATTACK:enterprise:T1132.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--66e16e88-626f-49c6-90f1-8c97286ef5dc
Joint Cybersecurity Advisory AA23-129A Snake Malware May 2023ATTACK:enterprise:S1189 → uses → ATTACK:enterprise:T1132.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--675ce023-6ef2-4c41-90b4-4d8b6896e8a2
GitHub Neo-reGeorg 2019ATTACK:enterprise:S0031 → uses → ATTACK:enterprise:T1132.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--6c0aae73-fe06-4aa3-8216-568d78747c6d
FireEye APT30ATTACK:enterprise:S9007 → uses → ATTACK:enterprise:T1132.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--6e83007d-1812-4627-b77b-e5571a871166
Gen Digital Kimsuky HTTPTroy October 2025ATTACK:enterprise:S1149 → uses → ATTACK:enterprise:T1132.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--71c1ca7f-0086-4168-94c2-b6d4bfa5938a
Mandiant ROADSWEEP August 2022ATTACK:enterprise:S0239 → uses → ATTACK:enterprise:T1132.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--78f8338a-ac4e-42cf-a887-cc35e842dc11
McAfee BankshotATTACK:enterprise:S0596 → uses → ATTACK:enterprise:T1132.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--951c72ac-3839-4716-a052-ffa79f5b62fe
Securelist ShadowPad Aug 2017ATTACK:enterprise:S0687 → uses → ATTACK:enterprise:T1132.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--97da1ec3-e4cd-451e-83be-d53adabb78ed
NCSC Cyclops Blink February 2022ATTACK:enterprise:G0094 → uses → ATTACK:enterprise:T1132.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--de92e2da-e367-4410-aff3-ececd981ae4f
Gen Digital Kimsuky HTTPTroy October 2025ATTACK:enterprise:S1100 → uses → ATTACK:enterprise:T1132.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--e5a20948-878d-4853-ba7a-d49eae0cbae9
Kaspersky ToddyCat June 2022ATTACK:enterprise:S1046 → uses → ATTACK:enterprise:T1132.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--eeb8c856-ed89-47f5-a725-e74e7a2c20c3
CYBERCOM Iranian Intel Cyber January 2022ATTACK:enterprise:S0681 → uses → ATTACK:enterprise:T1132.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--f32a117b-006e-4d4e-97c8-1fe1f91fefdf
SekoiaBourhis_DiceLoader_Feb2024ATTACK:enterprise:M1031 → mitigates → ATTACK:enterprise:T1132.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--f8e6711c-de3d-4c9f-a255-96fa7719e0a4