T1001

Data Obfuscation

ESXi · Linux · macOS · Windowsnothing on this site yetT1001 on attack.mitre.org

Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen.
MITRE ATT&CK 19.2, retrieved 2026-09-12

how MITRE says to see it

Detect Obfuscated C2 via Network Traffic Analysis

Detects excessive outbound traffic to remote host over HTTP(S) from uncommon or previously unseen processes.
Identifies custom or previously unseen userland processes initiating high-volume HTTP connections with low response volume.
Flags unexpected user applications initiating long-lived HTTP(S) sessions with irregular traffic patterns.

what reduces it

M1031 Network Intrusion Prevention. Network intrusion detection and prevention systems that use network signatures to identify traffic for specific adversary malware can be used to mitigate some obfuscation activity at the network level.

sub-techniques

T1001.001 Junk Data · not covered yet
T1001.002 Steganography · not covered yet
T1001.003 Protocol or Service Impersonation · not covered yet

The description, detection analytics and mitigations are reproduced from MITRE ATT&CK, version 19.2, under its terms of use. The checklists, hunts, labs and everything else linked here are this site’s.