Data Obfuscation T1001
Tactic: Command & Control
Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Events covered
4 catalog events are tagged with this technique by at least one rule.
| Provider | Event | Title |
|---|---|---|
| Sysmon | Event ID 1 | Process creation |
| Sysmon | Event ID 11 | FileCreate |
| Security-Auditing | Event ID 5136 | A directory service object was modified. |
| PowerShell | Event ID 4103 | Payload Context: ContextInfo User Data: UserData. |
Authoring guide
These 8 rules share fields, values, and exclusions.
Fields filtered most (19 distinct)
These fields appear most often in rule filters.
Top indicator values (54 distinct)
These values appear most often in rule predicates.
Exclusions (22 distinct)
These values appear most often in top-level exclusions.
Rules under this technique
These vendors publish rules tagged with this technique.
Sigma 2 rules
Splunk 3 rules
- Obfuscated Powershell Techniques (PowerShell)
- Windows PowGoop Beacon Decoding
- Windows Suspicious QEMU Execution