Data Obfuscation
- ID
- T1001
- Tactics
- TA0011 Command and Control
- Platforms
- ESXi, Linux, macOS, Windows
- Data sources
- Network Traffic Content, Network Connection Creation, Process Creation
- Source
- attack.mitre.org
- MITRE last modified
- 4 Sep 2026
Adversaries may obfuscate command and control traffic to make it more difficult to detect.[1] Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Sub-techniques (3)
Detection
- DET0053 Detect Obfuscated C2 via Network Traffic Analysis
Data components: Network Traffic Content, Network Connection Creation, Process Creation
Mitigations (1)
- M1031 Network Intrusion Prevention
Network intrusion detection and prevention systems that use network signatures to identify traffic for specific adversary malware can be used to mitigate some obfuscation activity at the network level.
Groups (1)
Software (13)
- S0381 FlawedAmmyy
- S0439 Okrum
- S0495 RDAT
- S0533 SLOTHFULMEDIA
- S0610 SideTwist
- S0682 TrailBlazer
- S1044 FunnyDream
- S1100 Ninja
- S1111 DarkGate
- S1120 FRAMESTING
- S1183 StrelaStealer
- S9001 SystemBC
- S9003 evilginx2