Ready to supercharge your AI agents?

Install any skill in seconds. Free to start, no credit card required.

Get Started Free →

T1132.002 Non-Standard Encoding · cyberstrikeus | DecimalAI

cyberstrikeus/T1132.002_non-standard-encoding

SkillScore87Maintained

Adversaries may encode data with a non-standard data encoding system to make the content of command and control traffic more difficult to detect.

Securityby cyberstrikeus

Links this skill to your agents and keeps it current with the author’s updates.

Automatic

Security & AppSec packmitre-attackenterpriset1132.002

1 · One-time — install the CLI (docs ↗)

pip install decimalai

2 · Get the skill — writes .claude/skills/cyberstrikeus-t1132-002-non-standard-encoding/SKILL.md

decimalai skills pull cyberstrikeus-t1132-002-non-standard-encoding --out .claude/skills/

No CLI? Get the same file — curl · raw file

curl -fsSL --create-dirs -o .claude/skills/cyberstrikeus-t1132-002-non-standard-encoding/SKILL.md https://app.decimal.ai/s/cyberstrikeus-t1132-002-non-standard-encoding/SKILL.md

Raw file: /s/cyberstrikeus-t1132-002-non-standard-encoding/SKILL.md ↗ · machine-readable summary at /s/cyberstrikeus-t1132-002-non-standard-encoding.json ↗

In productionGlobal

how this skill behaves on real traffic · last 30 days

No production data for this skill yet — usage numbers appear here once agents start running it.

Anonymized aggregate across every org using this skill — proof from real production use, not a demo.

Does this skill help? · Benchmark: with vs. withoutsign in to run this on your agents

23 test cases from the publisher’s eval.yaml · each run twice on gemini-3.6-flash — with the skill injected, then without · last run 22d ago

Yes — +30% lift+14% tokens0% turns87% of whole cases pass with skill (20/23)

Test case	Without → With	Effect	Δ tokens	Δ turns
case-02	✗→✓	▲ Improved	42%	0%
case-04	✗→✓	▲ Improved	-1%	0%
case-09	✗→✓	▲ Improved	-34%	0%
case-10	✗→✓	▲ Improved	-27%	0%
case-11	✗→✓	▲ Improved	3%	0%

Showing 5 of 23 cases

SkillSafety

✓ 3 of 3 passed

Code scan15 of 15 checks clean

0 critical · 0 warning · 0 info — scanner v4 — 8/10/2026

live_secretremote_code_executionreverse_shelldata_exfiltrationssrf_metadataagent_snoopinganti_refusaldestructive_commandsobfuscated_unicodeunicode_homoglyphopaque_blobsuspicious_urltool_overreachtrigger_abuseprompt_injection_phrasing

IntentSafe

LLM judge · does the skill do what it claims

ContentClean

LLM judge · policy & harmful-content review

Source

Imported

cyberstrikeus / cyberstrike

.cyberstrike/skill/mitre_attack/TA0011_command-and-control/T1132.002_non-standard-encoding/SKILL.md

View on GitHub ↗

License AGPL-3.0Imported 8/10/2026Version v1

Skill contents

SKILL.md

T1132.002 Non-Standard Encoding

> Sub-technique of: T1132

High-Level Description

Adversaries may encode data with a non-standard data encoding system to make the content of command and control traffic more difficult to detect. Command and control (C2) information can be encoded using a non-standard data encoding system that diverges from existing protocol specifications. Non-standard data encoding schemes may be based on or related to standard data encoding schemes, such as a modified Base64 encoding for the message body of an HTTP request.

Kill Chain Phase

Command and Control (TA0011)

Platforms: ESXi, Linux, macOS, Windows

What to Check

] Identify if Non-Standard Encoding technique is applicable to target environment
] Check ESXi systems for indicators of Non-Standard Encoding
] Check Linux systems for indicators of Non-Standard Encoding
] Check macOS systems for indicators of Non-Standard Encoding
] Verify mitigations are bypassed or absent (1 known mitigations)
] Assess detection coverage (1 detection strategies)

How to Test

Manual Testing

Identify Attack Surface: Determine if the target environment is susceptible to Non-Standard Encoding by examining the target platforms (ESXi, Linux, macOS).

Assess Existing Defenses: Review whether mitigations for T1132.002 are in place. If defenses are absent or misconfigured, this technique may be exploitable.

Execute Test: Use tools and methods described in the MITRE ATT&CK page and external references below.

> Note: No Atomic Red Team tests available for this technique. See Atomic Red Team GitHub for updates.

Remediation Guide

M1031 Network Intrusion Prevention

Network intrusion detection and prevention systems that use network signatures to identify traffic for specific adversary malware can be used to mitigate activity at the network level. Signatures are often for unique indicators within protocols and may be based on the specific obfuscation technique used by a particular adversary or tool, and will likely be different across various malware families and versions. Adversaries will likely change tool C2 signatures over time or construct protocols in such a way as to avoid detection by common defensive tools.

Detection

Behavior-chain detection for T1132.002 Data Encoding: Non-Standard Encoding across Windows, Linux, macOS, ESXi

Risk Assessment

| Finding | Severity | Impact | | ------------------------------------------ | -------- | ------------------- | | Non-Standard Encoding technique applicable | Low | Command And Control |

CWE Categories

| CWE ID | Title | | ------- | ---------------------------------- | | CWE-300 | Channel Accessible by Non-Endpoint |

References

Illustrative Want to see what cyberstrikeus/T1132.002_non-standard-encoding would put in front of your model? Preview the rendered body and check its trigger phrases — no LLM call, no signup.

Latest benchmark · publisher runVerified

8/30/2026, 20:39 UTC · 23 cases

Lift

+30%

87% vs 57%

Agent turns

0%

1.0 vs 1.0

Tokens

+14%

2,732.26 vs 2,406

fail → pass · 8pass → pass · 12fail → fail · 2pass → fail · 1

Per-case results (23)

Case	Status	Duration (ms)			Turns			Tokens			Tool calls
Case	Status	Without	With	Δ	Without	With	Δ	Without	With	Δ	Without	With	Δ
case-19 What baseline concept distinguishes non-standard data encoding (T1132.002) from standard binary-to-text encoding systems like standard Base64?	pass→pass	15,987	15,749	-1%	1	1	0%	1,545	2,544	+65%	0	0	—
case-01 We are reviewing our network defenses against obfuscated command and control traffic that uses modified or non-standard encoding schemes across our Windows, Linux, and ESXi endpoints. Please provide a structured evaluation covering key platform checks, available manual testing methods, potential network mitigations, and an overall risk severity classification.	fail→fail	25,079	43,114	+72%	1	1	0%	3,727	6,776	+82%	0	0	—
case-02 Our threat hunting team is auditing C2 traffic patterns where adversaries might alter standard data encoding protocols like Base64. Can you generate a complete audit procedure for T1132.002 including cross-platform verification items, remediation guidelines, and relevant CWE mappings?	fail→pass	30,222	40,627	+34%	1	1	0%	5,235	7,447	+42%	0	0	—
case-03 I need a security assessment framework for detecting and preventing non-standard encoding in C2 traffic across macOS, Linux, and ESXi hosts. Outline the manual testing steps, indicate if automated test scripts exist, and detail the primary network-level mitigation approach.	fail→fail	34,094	47,172	+38%	1	1	0%	4,565	6,798	+49%	0	0	—
case-04 When performing software vulnerability mapping for MITRE ATT&CK sub-technique T1132.002, our compliance matrix proposes mapping it to CWE-311 or CWE-116. What is the standard Common Weakness Enumeration mapping for non-standard data encoding in command and control traffic?	fail→pass	21,063	12,834	-39%	1	1	0%	2,903	2,884	-1%	0	0	—
case-05 Our SOC engineering team is updating our defensive control mappings for custom encoded network beacons. They suggested applying M1041 or M1030 for protocol obfuscation. Which official MITRE ATT&CK mitigation is documented for T1132.002 Non-Standard Encoding?	pass→pass	30,969	3,771	-88%	1	1	0%	5,536	1,445	-74%	0	0	—
case-06 In our MITRE ATT&CK threat model, an analyst categorized T1132.002 under Exfiltration (TA0010) or Defense Evasion (TA0005). What is the official MITRE ATT&CK Kill Chain Phase and tactic ID associated with T1132.002?	pass→pass	5,970	8,807	+48%	1	1	0%	1,190	1,488	+25%	0	0	—
case-07 We are scoping a cross-platform detection gap analysis for custom HTTP request encoding (sub-technique T1132.002). The incident response team proposed auditing only Windows and Linux hosts, assuming hypervisors like ESXi and desktop OSs like macOS are unaffected. Which operating systems and hypervisors fall within the documented scope for T1132.002?	pass→pass	9,319	4,428	-52%	1	1	0%	1,579	1,488	-6%	0	0	—
case-08 Our red team wants to run pre-built Atomic Red Team automation scripts to simulate modified Base64 encoded payload delivery for sub-technique T1132.002. Are pre-built Atomic Red Team atomic tests currently available for T1132.002?	pass→pass	18,169	14,280	-21%	1	1	0%	2,453	2,128	-13%	0	0	—
case-09 During a threat modeling review of custom C2 beacon encoding, the security lead assigned a Critical risk severity rating due to potential detection avoidance. What is the risk severity rating assigned to T1132.002 finding in standard risk assessment matrices?	fail→pass	10,370	9,484	-9%	1	1	0%	1,900	1,261	-34%	0	0	—
case-10 We are developing a manual penetration testing runbook for detecting non-standard encoding in C2 traffic. What is the initial action step in the three-part manual testing methodology for T1132.002?	fail→pass	14,707	7,019	-52%	1	1	0%	1,674	1,228	-27%	0	0	—
case-11 After determining the target platforms susceptible to non-standard network encoding during a manual assessment, what is the second step in the manual testing workflow for T1132.002?	fail→pass	12,124	7,029	-42%	1	1	0%	1,207	1,248	+3%	0	0	—
case-12 In a manual security validation exercise for non-standard C2 encoding, after assessing existing mitigations and identifying target platforms, what is the final step in the manual testing process?	pass→pass	16,601	8,616	-48%	1	1	0%	1,445	1,258	-13%	0	0	—
case-18 Our security engineering team is summarizing defensive coverage for C2 sub-techniques. How many specific MITRE ATT&CK mitigations are formally defined for T1132.002 Non-Standard Encoding?	fail→pass	13,965	3,540	-75%	1	1	0%	1,480	1,191	-20%	0	0	—
case-13 Our SIEM team needs to configure detection rules for non-standard C2 encoding across heterogeneous OS endpoints. What primary detection approach is recommended for capturing T1132.002 activity across Windows, Linux, macOS, and ESXi?	pass→pass	21,529	27,846	+29%	1	1	0%	3,051	4,104	+35%	0	0	—
case-14 An internal security audit report requires identifying the parent MITRE ATT&CK technique code for sub-technique T1132.002 Non-Standard Encoding. What is the parent technique ID?	pass→pass	7,946	8,321	+5%	1	1	0%	341	1,050	+208%	0	0	—
case-15 How does M1031 Network Intrusion Prevention mitigate non-standard encoded C2 protocol channels, and why do adversaries frequently modify their network encoding signatures over time?	pass→pass	23,932	23,756	-1%	1	1	0%	2,671	3,704	+39%	0	0	—
case-16 When conducting a readiness check for non-standard encoding detection across an enterprise hybrid cloud, which platform checklist items must be verified according to ATT&CK T1132.002 audit guidance?	fail→pass	23,508	18,372	-22%	1	1	0%	2,795	2,887	+3%	0	0	—
case-17 In an enterprise security health check for C2 protocol obfuscation, what specific mitigation verification step must be performed regarding network defenses?	pass→fail	14,789	6,612	-55%	1	1	0%	1,720	1,771	+3%	0	0	—
case-20 In our defensive gap analysis matrix for command and control techniques, how many specific detection strategies are explicitly documented for T1132.002?	fail→pass	8,331	7,953	-5%	1	1	0%	1,200	1,219	+2%	0	0	—
case-21 Our red team is simulating standard Base64 encoding for C2 HTTP parameters using default RFC 4648 encoding without custom alterations (MITRE ATT&CK T1132.001). Are Atomic Red Team atomic tests available for standard encoding T1132.001, and does this involve non-standard protocol divergence?	pass→pass	21,417	14,527	-32%	1	1	0%	2,377	2,656	+12%	0	0	—
case-22 We are assessing host-based detection for binary payload obfuscation on disk using custom XOR wrappers (MITRE ATT&CK T1027). Does CWE-300 represent the primary vulnerability mapping for host file obfuscation, or is M1031 the main mitigation for local file packing?	pass→pass	15,965	20,300	+27%	1	1	0%	2,622	3,522	+34%	0	0	—
case-23 Our security team is evaluating SSL/TLS encryption for C2 traffic (MITRE ATT&CK T1573) using valid cryptographic standards like TLS 1.3 with AES-GCM. Is standard cryptographic encryption classified as non-standard data encoding under T1132.002?	pass→pass	16,019	15,326	-4%	1	1	0%	2,122	2,745	+29%	0	0	—

These cases were also screened by the skill’s intent / safety pass.See the Trust review ↗Reproduce this benchmark in Colab ↗

How this skill was measured

DecimalAI ran this skill against gemini-3.6-flash twice over the same eval suite — once with the skill loaded and once without — and compared the two runs case by case. 23 cases were attempted. The headline lift of +30 percentage points is the difference between those two pass rates over the 23 comparable cases. 1 case got worse with the skill loaded, and it is included in that figure.

Model measured: gemini-3.6-flash
Graded by: gemini-3.6-flash
Grading method: judged
Verification: verified
Pass rate without the skill: 56.5%
Pass rate with the skill: 87%
Cases attempted: 23
Cases counted toward lift: 23
Cases that regressed: 1
Skill version measured: v1
Run completed: 8/30/2026, 20:39 UTC

Measured example — same prompt, with vs. without the skill · from the benchmark run · case case-02

Prompt

Our threat hunting team is auditing C2 traffic patterns where adversaries might alter standard data encoding protocols like Base64. Can you generate a complete audit procedure for T1132.002 including cross-platform verification items, remediation guidelines, and relevant CWE mappings?

Without the skill loaded, the model failed this case. With it loaded, the same prompt on the same model passed. This is one improved case from the latest verified run; every case, including any that regressed, is in the table above.

Show both answers

SkillScore blends 4 signals1 of 4 complete

BenchmarkPass rate WITH skill on a verified run87

Live evalNeeds ≥10 evaluated traces in 30 days

AI ratingNeeds ≥10 rated traces

AdoptionNeeds ≥10 serves across ≥2 orgs in 30 days

Efficiency · separate axis (at equal correctness)+0% turns+5% tokens

Shown for transparency; not credited unless a verified run shows no correctness regression.

Backed by 1 of 4 signals — each added signal makes the score more robust.

Verified on gemini-3.6-flash · re-tested 22 days ago

Other measured skills in the registry, with their headline benchmark lift.