MITRE ATT&CKsub-technique

T1001.001 Junk Data

Published 2020-03-15 Modified 2026-09-03 Official page ↗
Domain
enterprise
Tactics
Command And Control
Platforms
ESXi, Linux, macOS, Windows
Version
1.1
Created
2020-03-15

Description

Adversaries may add junk data to protocols used for command and control to make detection more difficult. By adding random or meaningless data to the protocols used for command and control, adversaries can prevent trivial methods for decoding, deciphering, or otherwise analyzing the traffic. Examples may include appending/prepending data with junk characters or writing junk characters between significant characters.

Related

Subtechnique of · MITRE ATT&CK (1)

  • T1001 Data Obfuscation technique

Tactic · MITRE ATT&CK (1)

  • TA0011 Command and Control tactic

Referenced by MITRE ATT&CK · mitigates (1)

  • M1031 Network Intrusion Prevention mitigation

Referenced by MITRE ATT&CK · uses (18)

  • S9020 LODEINFO software (malware)
  • S1246 BeaverTail software (malware)
  • S1164 UPSTYLE software (malware)
  • S1047 Mori software (malware)
  • S1020 Kevin software (malware)
  • S0682 TrailBlazer software (malware)
  • S0647 Turian software (malware)
  • S0632 GrimAgent software (malware)
  • S0626 P8RAT software (malware)
  • S0588 GoldMax software (malware)
  • S0574 BendyBear software (malware)
  • S0559 SUNBURST software (malware)
  • S0514 WellMess software (malware)
  • S0435 PLEAD software (malware)
  • G0007 APT28 group
  • S0016 P2P ZeuS software (malware)
  • S0022 Uroburos software (malware)
  • S0134 Downdelph software (malware)

Referenced by Compliance · mitigates (8)

  • CIS-13.8 Deploy a Network Intrusion Prevention Solution CIS Safeguard v8.1
  • NIST-AC-4 Information Flow Enforcement NIST 800-53 control
  • NIST-CA-7 Continuous Monitoring NIST 800-53 control
  • NIST-CM-2 Baseline Configuration NIST 800-53 control
  • NIST-CM-6 Configuration Settings NIST 800-53 control
  • NIST-SC-7 Boundary Protection NIST 800-53 control
  • NIST-SI-3 Malicious Code Protection NIST 800-53 control
  • NIST-SI-4 System Monitoring NIST 800-53 control

References