Home/ATT&CK Technique/Data Obfuscation
ATT&CK Technique

Data Obfuscation

T1001 · command-and-control

Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.

ESXiLinuxmacOSWindows
◆

Actors Using This

9
north_koreaAndariel
russiaAPT28
russiaAPT29
chinaAPT41
us_israel_joint_offensive_cyber_speculationDuqu / Duqu 2.0
north_koreaLazarus Group
chinaTropic Trooper
russiaTurla
chinaWorok
◈

Likely Attack Path

Techniques the same actors pair with this one distinctively - those showing up among actors who use this technique noticeably more than across all actors (lift > 1.15), grouped by kill-chain phase. The × is that lift multiplier; the shared-actor count is in the tooltip. A near-universal technique pairs with everything at baseline, so its list is short by design.
reconnaissance earlier
T1595 · Active Scanning ×11.33T1595.002 · Vulnerability Scanning ×11.33T1589 · Gather Victim Identity Information ×5.29
resource-development earlier
T1586 · Compromise Accounts ×5.29
persistence earlier
T1542.003 · Bootkit ×7.21T1542 · Pre-OS Boot ×5.67
privilege-escalation earlier
T1546.015 · Component Object Model Hijacking ×7.93
discovery earlier
T1680 · Local Storage Discovery ×21.16T1120 · Peripheral Device Discovery ×11.33
command-and-control same
T1001.002 · Steganography ×26.44T1104 · Multi-Stage Channels ×26.44T1071.002 · File Transfer Protocols ×15.87T1008 · Fallback Channels ×13.22
exfiltration later
T1030 · Data Transfer Size Limits ×11.33
other same
T1027.003 · Steganography ×8.81
▣

Mitigations

1
MITRE ATT&CK mitigations - vendor-agnostic guidance for reducing exposure to this technique.
M1031Network Intrusion Prevention

Use intrusion detection signatures to block traffic at network boundaries.

◈

Detection Coverage

1/6 layers
Coverage across standard detection surfaces. Rows marked none have no rule of that type mapped. Some are real blind spots worth closing; others are simply not applicable to this technique (e.g. YARA matches malware files, not network behaviour).
Behavioral / log (Sigma) none
Analytics (MITRE CAR) none
Runtime / container (Falco) none
File / malware (YARA) none
Network (Suricata/Snort) 102
Vuln scan (Nuclei) none
▣

Comply & Defend

NIST 800-53AC-04, CA-07, CM-02, CM-06, SC-07, SI-03, SI-04
D3FEND11 defensive techniques
Intelligence Graph · click any node to traverse
CVETechnique ActorTool Family
drag to reposition · click any node to traverse · button top-right enlarges
External lookups - second-class, for what we don’t hold ourselves
MITRE ATT&CKAtomic Red Teamcar (MITRE)
Vulnerabilities
CISA KEV catalog
CWE weaknesses
CAPEC attack patterns
Package vulnerabilities
Threat intelligence
Threat actors
Tools & malware
ATT&CK techniques
IOCs
Detection & defense
Sigma rules
YARA rules
Atomic Red Team tests
D3FEND countermeasures
Compliance
NIST 800-53
ISO 27001:2022
SOC 2 TSC
PCI-DSS v4.0
CIS Controls v8.1
About
All capabilities
Live statistics
Data sources
Privacy policy
Terms of service
threatengine.sh  ·  Open-source threat intelligence platform  ·  100+ authoritative sources  ·  Every fact traces to its origin