CyberStack

MITRE ATT&CK / Techniques / T1001.003

Data Obfuscation: Protocol or Service Impersonation

ID
T1001.003
Tactics
TA0011 Command and Control
Sub-technique of
T1001 Data Obfuscation
Platforms
ESXi, Linux, macOS, Windows
Data sources
Network Connection Creation, Network Traffic Content, Process Creation, Process Metadata
Source
attack.mitre.org
MITRE last modified
4 Sep 2026

Adversaries may impersonate legitimate protocols or web service traffic to disguise command and control activity and thwart analysis efforts. By impersonating legitimate protocols or web services, adversaries can make their command and control traffic blend in with legitimate network traffic.

Adversaries may impersonate a fake SSL/TLS handshake to make it look like subsequent traffic is SSL/TLS encrypted, potentially interfering with some security tooling, or to make the traffic look like it is related with a trusted entity.

Adversaries may also leverage legitimate protocols to impersonate expected web traffic or trusted services. For example, adversaries may manipulate HTTP headers, URI endpoints, SSL certificates, and transmitted data to disguise C2 communications or mimic legitimate services such as Gmail, Google Drive, and Yahoo Messenger.[1][2]

Detection

Mitigations (1)

M1031 Network Intrusion Prevention

Network intrusion detection and prevention systems that use network signatures to identify traffic for specific adversary malware can be used to mitigate some obfuscation activity at the network level.

Groups (3)

Software (19)

References

  1. ESET Okrum July 2019
  2. Malleable-C2-U42