Data Obfuscation: Junk Data
- ID
- T1001.001
- Tactics
- TA0011 Command and Control
- Sub-technique of
- T1001 Data Obfuscation
- Platforms
- ESXi, Linux, macOS, Windows
- Data sources
- Network Connection Creation, Process Access, Network Traffic Content, Process Creation
- Source
- attack.mitre.org
- MITRE last modified
- 4 Sep 2026
Adversaries may add junk data to protocols used for command and control to make detection more difficult.[1] By adding random or meaningless data to the protocols used for command and control, adversaries can prevent trivial methods for decoding, deciphering, or otherwise analyzing the traffic. Examples may include appending/prepending data with junk characters or writing junk characters between significant characters.
Detection
- DET0011 Detecting Junk Data in C2 Channels via Behavioral Analysis
Data components: Network Connection Creation, Process Access, Network Traffic Content, Process Creation
Mitigations (1)
- M1031 Network Intrusion Prevention
Network intrusion detection and prevention systems that use network signatures to identify traffic for specific adversary malware can be used to mitigate some obfuscation activity at the network level.
Groups (1)
Software (17)
- S0016 P2P ZeuS
- S0022 Uroburos
- S0134 Downdelph
- S0435 PLEAD
- S0514 WellMess
- S0559 SUNBURST
- S0574 BendyBear
- S0588 GoldMax
- S0626 P8RAT
- S0632 GrimAgent
- S0647 Turian
- S0682 TrailBlazer
- S1020 Kevin
- S1047 Mori
- S1164 UPSTYLE
- S1246 BeaverTail
- S9020 LODEINFO