Data Obfuscation T1001

Tactic: Command & Control

Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.

Events covered

4 catalog events are tagged with this technique by at least one rule.

Authoring guide

These 8 rules share fields, values, and exclusions.

Fields filtered most (21 distinct)

These fields appear most often in rule filters.

FieldRulesHowSample values
CommandLine2contains 2-nographic, .img, config.txt, frombase64string
EventID2eq 21, 4103
Action1eq 1blocked
AttributeLDAPDisplayName1eq 1otherfacsimiletelephonenumber, primaryinternationalisdnnumber, primarytelexnumber
AttributeValue1match 1*
Company1contains 1qemu
Description1contains 1qemu machine
EventType1eq 1proxylogs
HttpUserAgentOriginal1eq 1
Image1contains 1, ends_with 1:\program files\, :\program files\citrix\receiver..., :\program files\cylance\desktop\cylancesvc.exe
LogType1eq 1Agent Traffic Logs, agent traffic logs
ParentImage1ends_with 1rundll32.exe
Product1eq 1qemu
TargetFilename1contains 1, ends_with 1.sch, \local\microsoft\windows\schcache\
TotalBlockedEvents1gt 115

Top indicator values (55 distinct)

These values appear most often in rule predicates.

FieldKindValueRules (here)Corpus reach
Actioneq
blocked
1
AttributeLDAPDisplayNameeq
otherfacsimiletelephonenumber
1
AttributeLDAPDisplayNameeq
primaryinternationalisdnnumber
1
AttributeLDAPDisplayNameeq
primarytelexnumber
1
AttributeValuematch
*
1
CommandLinecontains
-nographic
12
CommandLinecontains
.img
1
CommandLinecontains
config.txt
1
CommandLinecontains
frombase64string
115
Companycontains
qemu
1
Descriptioncontains
qemu machine
1
EventIDeq
1
1241
EventIDeq
4103
1105
EventTypeeq
proxylogs
120
Imagecontains
:\program files\
1
Imagecontains
:\program files\sentinelone\sentinel agent
1
Imagecontains
:\windows\ccmsetup\autoupgrade\ccmsetup
1
Imagecontains
\microsoft office
1
Imageends_with
:\program files\citrix\receiver...
1
Imageends_with
:\program files\cylance\desktop\cylancesvc.exe
1
Imageends_with
:\windows\ccm\ccmexec.exe
1
Imageends_with
:\windows\system32\dllhost.exe
1
Imageends_with
:\windows\system32\dsac.exe
1
Imageends_with
:\windows\system32\efsui.exe
1
Imageends_with
:\windows\system32\mmc.exe
1
Imageends_with
:\windows\system32\svchost.exe
1
Imageends_with
:\windows\system32\wbem\wmiprvse.exe
1
Imageends_with
:\windows\system32\windowspowershell\v1.0\powershell.exe
1
Imageends_with
\landesk\ldclient\ldapwhoami.exe
1
Imageends_with
\outlook.exe
113

Exclusions (22 distinct)

These values appear most often in top-level exclusions.

FieldKindValueRules excluding
Imagecontains
:\program files\
1
Imagecontains
:\program files\sentinelone\sentinel agent
1
Imagecontains
:\windows\ccmsetup\autoupgrade\ccmsetup
1
Imagecontains
\microsoft office
1
Imageends_with
:\program files\citrix\receiver...
1
Imageends_with
:\program files\cylance\desktop\cylancesvc.exe
1
Imageends_with
:\windows\ccm\ccmexec.exe
1
Imageends_with
:\windows\system32\dllhost.exe
1
Imageends_with
:\windows\system32\dsac.exe
1
Imageends_with
:\windows\system32\efsui.exe
1
Imageends_with
:\windows\system32\mmc.exe
1
Imageends_with
:\windows\system32\svchost.exe
1
Imageends_with
:\windows\system32\wbem\wmiprvse.exe
1
Imageends_with
:\windows\system32\windowspowershell\v1.0\powershell.exe
1
Imageends_with
\landesk\ldclient\ldapwhoami.exe
1

Rules under this technique

These vendors publish rules tagged with this technique.

Platform (all)
Domain (all)

Sigma 2 rules

Splunk 3 rules

Kusto 3 rules