Applied Cybernetics Group Sat, Nov 7, 2026 · data 12:17Z
thrunt.me thrunt me harder

Applied Cybernetics Group

T1001 Data Obfuscation

Technique
T1001
Tactics
Command and Control
Research, 90 days
1
KEV CVEs mapped
2
SigmaHQ rules
0
Elastic, Splunk
2
thrunt rules
0
Upstream
https://attack.mitre.org/techniques/T1001

MITRE description

Adversaries may obfuscate command and control traffic to make it more difficult to detect.(Citation: Bitdefender FunnyDream Campaign November 2020) Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.

KEV CVEs mapped to this technique

MITRE CTID maps these KEV CVEs to this technique by hand. They are the actively exploited vulnerabilities behind this technique's KEV signal.

Research citing this technique

Reports and advisories from the last 90 days that cite this technique.

Detection coverage

No thrunt rule, on purpose rejected

content-property, not event-property; visible slice child-covered (T1001.003); NIDS/EDR control class

Data Obfuscation is a property of C2 payload content, junk bytes, steganographic embedding, protocol impersonation, and payload-content properties are not single-event field matches. Asserting that traffic is obfuscated over proxy, DNS, or Zeek metadata requires entropy or distribution analysis across a session, which is analytics, not base Sigma; and any single-event signature specific enough to fire without drowning the queue is by construction a family artifact, which belongs in per-family emerging-threat rules or the intel feed, not in a parent behavioral rule. Where an obfuscation procedure does leave a discrete, field-matchable artifact, the community already covers it at the child level: T1001.003 protocol impersonation carries 'Suspicious LDAP-Attributes Used' (high) and 'ADSI-Cache File Creation By Uncommon Tool' (medium). The KEV signal attached to this candidate, the Apple CoreAudio/RPAC zero-click chain (CVE-2025-31200/31201), is spyware exploitation on iOS/macOS surfaces with no base-Sigma logsource, and yields nothing a parent rule could match. Sigma is the wrong control class here: generic C2 obfuscation belongs to NIDS payload analytics and EDR C2 heuristics, and thrunt will not publish a rule that pretends otherwise.

Compensating controls

  • NIDS with payload analytics (Suricata rulesets; Zeek entropy/protocol-conformance scripting)
  • TLS fingerprint anomaly detection (JA3/JA4) at the egress boundary
  • Egress proxy enforcing protocol conformance: impersonated protocols fail at the gateway
  • EDR network C2 heuristics and beacon-shape detection

Revisit when: A recurring, field-matchable obfuscation artifact from an active family (fixed junk-padding marker, stego container path on disk, or named protocol-impersonation header) surfacing in research or KEV evidence: authored under the specific child (T1001.001/.002/.003), not the parent; or broad consumer adoption of a Zeek logsource convention that makes a concrete impersonation procedure matchable.

Elastic and Splunk rules

Signal counts reflect the current corpus snapshot. Research citations are the technique IDs named in vendor reports and government advisories from the last 90 days; KEV mappings come from MITRE CTID. Coverage is the SigmaHQ rule inventory (core, emerging-threats, threat-hunting) plus Elastic and Splunk production rules. Rule bodies are not mirrored; links go upstream.