T1001.001 Junk Data

coverage gap

Technique: T1001.001
Tactics: Command and Control
Research, 90 days: 1
KEV CVEs mapped: 0
SigmaHQ rules: 0
Elastic, Splunk: 0
thrunt rules: 0
Upstream: https://attack.mitre.org/techniques/T1001/001

MITRE description

Adversaries may add junk data to protocols used for command and control to make detection more difficult.(Citation: FireEye SUNBURST Backdoor December 2020) By adding random or meaningless data to the protocols used for command and control, adversaries can prevent trivial methods for decoding, deciphering, or otherwise analyzing the traffic. Examples may include appending/prepending data with junk characters or writing junk characters between significant characters.

Research citing this technique

Reports and advisories from the last 90 days that cite this technique.

2026-10-15 Google Threat Intelligence: Investigating Ephemeral Supply Chain Tampering

Detection coverage

No rule covers this technique yet. No SigmaHQ, Elastic or Splunk production rule carries its tag, and thrunt hasn't written one. Techniques like this are where the next thrunt rules come from; the gap map has the full list.

Signal counts reflect the current corpus snapshot. Research citations are the technique IDs named in vendor reports and government advisories from the last 90 days; KEV mappings come from MITRE CTID. Coverage is the SigmaHQ rule inventory (core, emerging-threats, threat-hunting) plus Elastic and Splunk production rules. Rule bodies are not mirrored; links go upstream.