Data Obfuscation (T1001) is a command and control technique. Adversaries make the traffic between a compromised host and their server harder to read or less noticeable. The content is hidden, though not necessarily encrypted. MITRE lists Windows, Linux, macOS and ESXi as affected platforms.
The technique is a parent for three sub-techniques: junk data, steganography, and protocol or service impersonation. Each one is a different way of making ordinary-looking traffic carry something it should not.
How attackers use it
MITRE describes the methods at a high level. An adversary may add junk data to protocol traffic so that simple decoding fails. They may hide messages inside other content, a practice called steganography. Or they may impersonate a legitimate protocol so the connection looks like something the network already expects.
The goal is the same in every case. If the traffic looks boring, nobody reads it. Defenders who only look for known bad strings will miss it.
How to detect it
MITRE's detection strategy for this technique is about behavior on the network, tied back to the process that made the connection. The analytics point at three patterns:
- Excessive outbound HTTP or HTTPS traffic to a remote host from an uncommon or previously unseen process.
- A custom or never-before-seen userland process making many HTTP connections with little response data coming back.
- A user application holding long-lived HTTPS sessions with irregular traffic patterns.
To act on these, you need two data sources joined together: network connection logs and process information. A flow record that says only "10.0.4.12 talked to a remote host" is hard to use. A record that says "an unsigned binary in a user temp folder talked to a remote host for six hours" is something an analyst can work with.
Baseline first. List which processes normally talk out from your servers and workstations. Anything outside that list that holds a steady connection deserves a look.
How to reduce the risk
MITRE lists one mitigation, Network Intrusion Prevention. Network intrusion detection and prevention systems that use network signatures for specific adversary malware can mitigate some obfuscation activity at the network level.
Be realistic about what that buys you. Signatures catch known tools, and obfuscation exists to defeat simple matching. Treat signatures as one layer. Pair them with egress controls that only let approved processes and destinations connect, and with the behavioral analytics above.
Where defenders go wrong
Three mistakes show up again and again with obfuscated C2.
The first is treating encryption as the only problem. Teams build TLS inspection and assume the job is done. MITRE is clear that obfuscation does not have to involve encryption. Padding, hiding data in other content and mimicking protocols all work on plain traffic too.
The second is trusting the label. If a flow says port 443, many tools call it web traffic. Impersonation exists to exploit that trust.
The third is looking at one connection at a time. Obfuscated channels are best seen over time and by process: how long a session lasts, how much data goes out compared to what comes back, and whether the same unfamiliar process returns day after day.
A simple hunt you can run
Pick one server tier, such as your application servers. For one week, collect outbound connection logs with process names. Then sort by process and destination, and review anything that is new to the list. Servers have small, stable outbound habits, so the new entries are few and easy to explain or escalate.
Repeat the hunt monthly. The first run builds the baseline, and later runs get faster.
Quick check
Does obfuscated C2 traffic have to be encrypted?
No. MITRE says the communications are hidden but not necessarily encrypted. Junk data, steganography and protocol impersonation can all hide intent without any encryption at all.
Why join network logs with process data?
Because the odd part is usually which process is talking, not that a connection exists. An unknown process holding a long HTTPS session stands out only when you can see both sides.
