Data Obfuscation T1001

Tactic: Command & Control

Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.

Events covered

4 catalog events are tagged with this technique by at least one rule.

Authoring guide

Patterns shared across the 8 rules above: which fields they filter on, what specific values they look for, and what they exclude. The catalog normalizes field names across vendors so Sigma's Image, Elastic's process.name, and Splunk's process_name collapse into one row. Each rule contributes at most once per row.

Fields filtered most (21 distinct)

The fields most rules look at when detecting this technique. The How column shows the operators authors use (eq, wildcard, regex_match, match) and how often each appears. Sample values are concrete examples to start from, not an exhaustive list.

FieldRulesHowSample values
CommandLine2contains 2-nographic, .img, config.txt, frombase64string
EventID2eq 21, 4103
Action1eq 1Blocked
AttributeLDAPDisplayName1eq 1otherfacsimiletelephonenumber, primaryinternationalisdnnumber, primarytelexnumber
AttributeValue1match 1*
Company1contains 1qemu
Description1contains 1qemu machine
EventType1eq 1proxylogs
HttpUserAgentOriginal1eq 1
Image1contains 1, ends_with 1:\program files\, :\program files\citrix\receiver..., :\program files\cylance\desktop\cylancesvc.exe
LogType1eq 1Agent Traffic Logs
ParentImage1ends_with 1rundll32.exe
Product1eq 1QEMU
TargetFilename1contains 1, ends_with 1.sch, \local\microsoft\windows\schcache\
TotalBlockedEvents1gt 115

Top indicator values (54 distinct)

Specific (field, operator, value) combinations the rules check for, ranked by how many rules under this technique use each one. The Corpus reach column counts how many rules across the entire catalog (any technique) check the same combination. High numbers point to widely-used indicators that are likely noisy on their own; combine them with another condition for useful signal. Blank means the combination is specific to rules under this technique. Click a value to expand the rules under this technique that use it.

FieldKindValueRules (here)Corpus reach
Actioneq
Blocked
16
AttributeLDAPDisplayNameeq
otherfacsimiletelephonenumber
1
AttributeLDAPDisplayNameeq
primaryinternationalisdnnumber
1
AttributeLDAPDisplayNameeq
primarytelexnumber
1
AttributeValuematch
*
1
CommandLinecontains
-nographic
12
CommandLinecontains
.img
1
CommandLinecontains
config.txt
1
CommandLinecontains
frombase64string
112
Companycontains
qemu
1
Descriptioncontains
qemu machine
1
EventIDeq
1
1237
EventIDeq
4103
1105
EventTypeeq
proxylogs
120
Imagecontains
:\program files\
1
Imagecontains
:\program files\sentinelone\sentinel agent
1
Imagecontains
:\windows\ccmsetup\autoupgrade\ccmsetup
1
Imagecontains
\microsoft office
1
Imageends_with
:\program files\citrix\receiver...
1
Imageends_with
:\program files\cylance\desktop\cylancesvc.exe
1
Imageends_with
:\windows\ccm\ccmexec.exe
1
Imageends_with
:\windows\system32\dllhost.exe
1
Imageends_with
:\windows\system32\dsac.exe
1
Imageends_with
:\windows\system32\efsui.exe
1
Imageends_with
:\windows\system32\mmc.exe
1
Imageends_with
:\windows\system32\svchost.exe
1
Imageends_with
:\windows\system32\wbem\wmiprvse.exe
1
Imageends_with
:\windows\system32\windowspowershell\v1.0\powershell.exe
1
Imageends_with
\landesk\ldclient\ldapwhoami.exe
1
Imageends_with
\outlook.exe
114

Exclusions (22 distinct)

Field/operator/value combinations excluded by rules under this technique (top-level not() clauses), sorted by how many rules exclude each. These are the false-positive paths the community has learned to filter out. A new rule that ignores the high-count entries here will likely fire on the same noisy paths. Click a value to expand the rules under this technique that exclude it.

FieldKindValueRules excluding
Imagecontains
:\program files\
1
Imagecontains
:\program files\sentinelone\sentinel agent
1
Imagecontains
:\windows\ccmsetup\autoupgrade\ccmsetup
1
Imagecontains
\microsoft office
1
Imageends_with
:\program files\citrix\receiver...
1
Imageends_with
:\program files\cylance\desktop\cylancesvc.exe
1
Imageends_with
:\windows\ccm\ccmexec.exe
1
Imageends_with
:\windows\system32\dllhost.exe
1
Imageends_with
:\windows\system32\dsac.exe
1
Imageends_with
:\windows\system32\efsui.exe
1
Imageends_with
:\windows\system32\mmc.exe
1
Imageends_with
:\windows\system32\svchost.exe
1
Imageends_with
:\windows\system32\wbem\wmiprvse.exe
1
Imageends_with
:\windows\system32\windowspowershell\v1.0\powershell.exe
1
Imageends_with
\landesk\ldclient\ldapwhoami.exe
1

Rules under this technique

Every rule in the catalog tagged with this technique, grouped by vendor. Click a rule title for its full predicates, exclusions, and indicators.

Platform (all)
Domain (all)

Sigma 2 rules

Splunk 3 rules

Kusto 3 rules