Payload Encoder — Generic Encoding (Base64 / Hex / XOR / URL / HTML / Unicode)
Chase the decoder, not the encoding. An attacker can encode arbitrarily many ways, but at some point something has to decode it, and that call is a far more stable detection surface.
Open in Red Team Toolkit — payloadPayload Encoder — Generic Encoding (Base64 / Hex / XOR / URL / HTML / Unicode)
What the attacker produced
The Payload Encoder produced a payload encoded in one of the standard schemes: Base64, hexadecimal, XOR, URL-encoding, HTML entity encoding, Unicode escape sequences, or raw binary. These encodings are used to obscure payload content from signature-based controls, embed binary data in text-only channels, or bypass input filters that block specific characters. At some point the encoded blob must be decoded before execution — that decoding step is the stable detection surface.
Chase the decoder, not the encoding. An attacker can encode arbitrarily many ways, but at some point something has to decode it, and that call is a far more stable detection surface.
Telemetry generated
| Log source | Field / identifier | What it shows |
|---|---|---|
| Security 4688 / Sysmon 1 | CommandLine / Image | Process creation showing decoder utility invocation — certutil.exe with -decode, PowerShell with [Convert]::FromBase64String, python -c with b64decode, etc. |
| Sysmon Event 11 | TargetFilename | File creation of the decoded artifact on disk. Correlating the decoder process (Event 1) with the output file (Event 11) gives you both the mechanism and the dropped payload. |
| Proxy / NDR | URI / Header / Body | Encoded blobs in HTTP URIs, Cookie headers, or custom headers. Long Base64-alphabet runs in query parameters are anomalous and detectable by length and character-class heuristics. |
Detection rules
title: Certutil Decode or Encode Abuse
id: c4d5e6f7-a8b9-0123-cdef-012345678901
status: stable
description: Detects certutil.exe used for decoding or encoding — a common LOLBin technique for payload staging
references:
- https://attack.mitre.org/techniques/T1140/
author: Cal Security & Forensics
date: 2026/08/05
tags:
- attack.defense_evasion
- attack.t1140
- attack.t1027
logsource:
category: process_creation
product: windows
detection:
selection:
Image|endswith: '\certutil.exe'
CommandLine|contains:
- '-decode'
- '/decode'
- '-urlcache'
- '/urlcache'
- '-encode'
- '-decodehex'
condition: selection
falsepositives:
- Certificate management operations (rare on workstations; document and suppress by user)
level: highEvasion & counters
Multi-layer custom encoding — applying XOR then Base64 then hex to make the blob unrecognisable to any single-scheme detector.
Detect the decoder invocation and the resulting file write (Sysmon 11). These events survive arbitrary encoding depth because something must decode the blob, and that call is observable regardless of how many layers were applied.
Splitting the encoded blob across multiple variables or string concatenations to break length-based heuristics.
Entropy and length heuristics still fire on the individual chunks if they are large enough. More importantly, the reassembly and decode call remain observable in process telemetry.
Using a non-standard Base64 alphabet (URL-safe, custom character substitution) to evade Base64-specific pattern matching.
Character-class and length heuristics apply to any high-entropy, long alphanumeric run regardless of the specific alphabet. A decode call is still required and remains the primary detection surface.
Rule tuning
Preventive control
Apply application control (WDAC or AppLocker) to restrict certutil.exe and other LOLBins from running for standard users. Block script interpreters (wscript, cscript, mshta) for users who do not require them. These controls do not prevent all encoding abuse but they eliminate the most common decoder utilities.