---
{
  "title": "Data Encoding",
  "summary": "Data encoding transforms command traffic into another representation.",
  "topic": "networking",
  "level": "Intermediate",
  "updated": "2026-10-12",
  "published": "2026-10-04",
  "units": [
    2
  ],
  "aliases": [
    "T1132"
  ],
  "sources": [
    {
      "title": "MITRE ATT&CK T1132: Data Encoding",
      "url": "https://attack.mitre.org/techniques/T1132"
    }
  ],
  "editorialVersion": 2
}
---

## What it means

Data encoding transforms command traffic into another representation. Encoding changes readability but does not provide confidentiality or establish trustworthy content.


## An investigation example

A suspicious process exchanges encoded messages that become meaningful commands when decoded during isolated analysis.

## Evidence to examine

Preserve raw messages, decoded content, protocol context, process ownership, and the decoding method used.

## A common analytical pitfall

Common encodings such as Base64 appear in benign applications, and their presence is not a verdict.

## Response considerations

Correlate decoded behavior with host evidence and avoid conclusions based solely on encoded-looking strings.


## Representation does not provide secrecy

Encoding changes information into a form suitable for storage or transport. Standard schemes are normally reversible without a secret key, so encoding is not equivalent to encryption. An intruder may encode control information to fit a protocol or avoid straightforward text matching, but legitimate applications do the same for ordinary compatibility reasons.

Identify the representation through evidence rather than appearance alone. A string resembling a common encoding may be arbitrary data or only one part of a larger format. Preserve the original bytes and record the decoding method. A decoded result can contain untrusted instructions or sensitive content and should not be executed casually.

## A fictional encoded request field

An academy's training capture contains a request field that decodes into structured text. Analysts compare the field with the expected client's documented behavior and the originating process. The ability to decode it does not establish whether its purpose is malicious. Context and subsequent actions determine the significance.

Multiple transformations can complicate interpretation. Compression, serialization, and encryption may be combined with encoding, and a failed decoding attempt does not prove the data is encrypted. Record assumptions and errors so another analyst can test them. Do not upload potentially private payloads to uncontrolled online decoders for convenience.

## Transform harmless text

Use a short fictional message and a standard local encoding tool in a training environment. Encode and decode it, then explain which operation requires a secret and which does not. Compare the original and transformed lengths. The exercise should focus on representation, not constructing a hidden communication channel.

For detection, combine representation with process and destination context. Blocking every encoded field would break many legitimate applications. A useful finding explains why this particular field, client, or sequence differs from expected behavior and separates the observed decoding result from an unsupported conclusion about control or data theft.

## Related concepts

- [[packet-analysis]]
- [[exfiltration]]
- [[network-segmentation]]