Applied Cybernetics Group
T1001 — Data Obfuscation
coverage gap
- Technique
T1001- Tactics
- Command and Control
- MISP citations
- 0
- KEV CVEs mapped
- 2
- Community rules
- 0
- thrunt rules
- 0
- Upstream
- https://attack.mitre.org/techniques/T1001
MITRE description
Adversaries may obfuscate command and control traffic to make it more difficult to detect.(Citation: Bitdefender FunnyDream Campaign November 2020) Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
KEV CVEs mapped to this technique
Per MITRE CTID's hand-curated KEV→ATT&CK mappings — these are the actively-exploited vulnerabilities behind this technique's KEV signal.
Detection coverage
content-property, not event-property; visible slice child-covered (T1001.003); NIDS/EDR control class
Data Obfuscation is a property of C2 payload content — junk bytes, steganographic embedding, protocol impersonation — and payload-content properties are not single-event field matches. Asserting that traffic is obfuscated over proxy, DNS, or Zeek metadata requires entropy or distribution analysis across a session, which is analytics, not base Sigma; and any single-event signature specific enough to fire without drowning the queue is by construction a family artifact, which belongs in per-family emerging-threat rules or the intel feed, not in a parent behavioral rule. Where an obfuscation procedure does leave a discrete, field-matchable artifact, the community already covers it at the child level: T1001.003 protocol impersonation carries 'Suspicious LDAP-Attributes Used' (high) and 'ADSI-Cache File Creation By Uncommon Tool' (medium). The KEV signal attached to this candidate — the Apple CoreAudio/RPAC zero-click chain (CVE-2025-31200/31201) — is spyware exploitation on iOS/macOS surfaces with no base-Sigma logsource, and yields nothing a parent rule could match. Sigma is the wrong control class here: generic C2 obfuscation belongs to NIDS payload analytics and EDR C2 heuristics, and thrunt will not publish a rule that pretends otherwise.
Compensating controls
- NIDS with payload analytics (Suricata rulesets; Zeek entropy/protocol-conformance scripting)
- TLS fingerprint anomaly detection (JA3/JA4) at the egress boundary
- Egress proxy enforcing protocol conformance — impersonated protocols fail at the gateway
- EDR network C2 heuristics and beacon-shape detection
Revisit when: A recurring, field-matchable obfuscation artifact from an active family (fixed junk-padding marker, stego container path on disk, or named protocol-impersonation header) surfacing in MISP/KEV evidence — authored under the specific child (T1001.001/.002/.003), not the parent; or broad consumer adoption of a Zeek logsource convention that makes a concrete impersonation procedure matchable.