MITRE ATT&CKtechnique

T1001 Data Obfuscation

Published 2017-05-31 Modified 2026-09-03 Official page ↗
Domain
enterprise
Tactics
Command And Control
Platforms
ESXi, Linux, macOS, Windows
Version
1.2
Created
2017-05-31

Description

Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.

Related

Tactic · MITRE ATT&CK (1)

  • TA0011 Command and Control tactic

Referenced by MITRE ATT&CK · mitigates (1)

  • M1031 Network Intrusion Prevention mitigation

Referenced by MITRE ATT&CK · subtechnique of (3)

Referenced by MITRE ATT&CK · uses (15)

  • S9003 evilginx2 software (tool)
  • S9001 SystemBC software (malware)
  • S1183 StrelaStealer software (malware)
  • S1120 FRAMESTING software (malware)
  • S1111 DarkGate software (malware)
  • S1100 Ninja software (malware)
  • C0014 Operation Wocao campaign
  • S1044 FunnyDream software (malware)
  • S0682 TrailBlazer software (malware)
  • S0610 SideTwist software (malware)
  • S0533 SLOTHFULMEDIA software (malware)
  • S0495 RDAT software (malware)
  • S0439 Okrum software (malware)
  • S0381 FlawedAmmyy software (malware)
  • G0047 Gamaredon Group group

Referenced by Compliance · mitigates (8)

  • CIS-13.8 Deploy a Network Intrusion Prevention Solution CIS Safeguard v8.1
  • NIST-AC-4 Information Flow Enforcement NIST 800-53 control
  • NIST-CA-7 Continuous Monitoring NIST 800-53 control
  • NIST-CM-2 Baseline Configuration NIST 800-53 control
  • NIST-CM-6 Configuration Settings NIST 800-53 control
  • NIST-SC-7 Boundary Protection NIST 800-53 control
  • NIST-SI-3 Malicious Code Protection NIST 800-53 control
  • NIST-SI-4 System Monitoring NIST 800-53 control

References