T1001.001 — Junk Data

Tactic: Command and Control · Platforms: ESXi, Linux, macOS, Windows

Adversaries may add junk data to protocols used for command and control to make detection more difficult. By adding random or meaningless data to the protocols used for command and control, adversaries can prevent trivial methods for decoding, deciphering, or otherwise analyzing the traffic.…

Sub-technique of Data Obfuscation (T1001).

Sigma detection rules (4)

title: "T1001.001 Data Obfuscation: Junk Data"
id: f2b15ee0-c62a-408b-a0f3-a53f1375889b
description: 'Junk/padding data is not directly observable via Windows telemetry; proxies via abnormally long DNS query names (EventID 22). (Data Component: DNS Query; baseline tier: windows-eventid.) Tune using: PayloadEntropyThreshold, TimeWindow, UserContext.'
references:
  - https://attack.mitre.org/techniques/T1001/001
author: Shahrukh Khan
date: 2026-02-16
license: MIT
tags:
  - attack.command-and-control
  - attack.t1001.001

logsource:
  category: dns_query
  product: windows
  service: sysmon

detection:
  selection:
    EventID: '22'
  selection_long_query:
    QueryName|re: '.{60,}'
  filter_system_account:
    User|contains:
      - 'SYSTEM'
      - 'LOCAL SERVICE'
      - 'NETWORK SERVICE'
  condition: selection and selection_long_query and not filter_system_account

falsepositives:
  - Legitimate long encoded/CDN-generated subdomains.

level: medium

title: "T1001.001 Data Obfuscation: Junk Data"
id: f881b031-2a34-4bb0-b641-4c8e5ea01d07
description: 'Detecting Junk Data in C2 Channels via Behavioral Analysis. The padding or entropy bytes this technique describes live inside the C2 protocol stream itself, which raw auditd process telemetry cannot inspect at all since it has no visibility into packet content; a bare dd if=/dev/urandom invocation, as the previous version used, is a generic disk-wipe or key-generation utility with no inherent tie to C2 traffic. Retargeted to flag shell one-liners (sh, bash, or dash invoked with -c) whose captured command-line combines a /dev/urandom read with a network-transfer utility such as nc, ncat, socat, curl, or openssl s_client in the same invocation, the closest process-level signal auditd can actually observe for random bytes being generated and piped or sent over the wire. Tune using: NetToolAllowList, ProcessWhitelist, DataRatioThreshold.'
references:
  - https://attack.mitre.org/techniques/T1001/001
author: Shahrukh Khan
date: 2026-05-16
license: MIT
tags:
  - attack.command-and-control
  - attack.t1001.001

logsource:
  category: process_creation
  product: linux
  service: auditd

detection:
  selection_shell:
    type: EXECVE
    exe|endswith:
      - '/sh'
      - '/bash'
      - '/dash'
    a1: '-c'
  selection_urandom:
    a2|contains: '/dev/urandom'
  selection_net_tool:
    a2|contains:
      - 'nc '
      - 'ncat '
      - 'socat '
      - 'curl '
      - 'openssl s_client'

  condition: all of selection_*

falsepositives:
  - Legitimate testing or benchmarking scripts that pipe /dev/urandom through netcat or curl (e.g. network throughput testing) will also match; auditd cannot confirm the transferred bytes are junk padding inside an established C2 protocol versus a deliberate test transfer.

level: low

title: "T1001.001 Data Obfuscation: Junk Data"
id: e15ca065-7aa6-49f0-8180-75e97b3ad570
description: 'Detecting Junk Data in C2 Channels via Behavioral Analysis. (Retargeted to the network_connection macOS unified-log telemetry that actually captures this techniques behavior; see logsource below.) Tune using: ParentProcessCheck, HostWhitelist.'
references:
  - https://attack.mitre.org/techniques/T1001/001
author: Shahrukh Khan
date: 2026-05-28
license: MIT
tags:
  - attack.command-and-control
  - attack.t1001.001

logsource:
  category: network_connection
  product: macos

detection:
  selection:
    Image|endswith:
      - '/nc'
      - '/ncat'
      - '/socat'
  selection_parent:
    ParentImage|endswith:
      - '/osascript'
      - '/python3'
      - '/bash'
  condition: selection and selection_parent

falsepositives:
  - Network diagnostic or QA tooling that intentionally sends padded or randomized traffic for latency testing.

level: medium

title: "T1001.001 Data Obfuscation: Junk Data"
id: 48c8d167-65db-4604-9e50-6d8b86d0b288
description: 'Detecting Junk Data in C2 Channels via Behavioral Analysis. (Retargeted to the process_creation ESXi telemetry that actually captures this techniques behavior; see logsource below.) Tune using: TLSFingerprintMismatch, UnusualDestinationPorts.'
references:
  - https://attack.mitre.org/techniques/T1001/001
author: Shahrukh Khan
date: 2026-02-01
license: MIT
tags:
  - attack.command-and-control
  - attack.t1001.001

logsource:
  product: esxi
  service: hostd

detection:
  selection_fw:
    Message|contains: 'Firewall'
  selection_change:
    Message|contains|all:
      - 'ruleset'
      - 'enabled'

  condition: selection_fw and selection_change

falsepositives:
  - ESXi host logs do not capture packet payload content so genuine junk data padding inside protocol traffic cannot be observed; this only flags firewall ruleset changes that may precede masked command and control traffic, which routine firewall administration also produces.

level: low

Related sub-techniques

• T1001.003 Protocol or Service Impersonation
• T1001.002 Steganography

Explore

• All Sigma rules for MITRE ATT&CK
• Sigma rule format guide
• Full T1001.001 intelligence — ATT&CK Intelligence View
• Official MITRE ATT&CK entry
• Built by Shahrukh Khan