Technique Search Instance

HTTP 200 OK
Allow: GET, PUT, PATCH, DELETE, HEAD, OPTIONS
Content-Type: application/json
Vary: Accept

{
    "id": 100,
    "key": "custom-encoding",
    "unprotect_id": "U0702,E1027.m03",
    "name": "Custom Encoding",
    "description": "Malware often uses custom encoding schemes to conceal their payloads and avoid detection. These custom schemes can be full custom layers, or they can be variations of known algorithms such as XOR or Base64. Using custom encoding schemes allows malware to encode their payloads in a unique way that can be difficult for security tools and forensic investigators to detect. \r\n\r\nIn some cases, the custom encoding scheme may be a combination of different algorithms, such as using XOR to encrypt the payload and then using Base64 to encode the resulting ciphertext. This can make the encoded payload even more difficult to detect and analyze.\r\n\r\nTo safeguard payloads and communication channels, multiple data encoding operations (e.g., XOR, ADD, SUB, ROL, and ROR) can also be chained together with a randomly generated key. These operations are not only simple to execute and reverse but also demand minimal computing resources.",
    "resources": "https://securityintelligence.com/an-example-of-common-string-and-payload-obfuscation-techniques-in-malware/",
    "creation_date": "2019-03-18T14:54:13Z",
    "tags": "Custom encoding schemes,\r\nConceal,\r\nPayloads,\r\nFull custom layers,\r\nVariations,\r\nKnown algorithms,\r\nXOR,\r\nBase64,",
    "modification_date": "2023-10-04T10:44:46.799000Z",
    "category": [
        7
    ],
    "rules": [],
    "attachments": [],
    "featured_api": [],
    "contributors": []
}