Data Obfuscation
Where this stands
A reviewer read the telemetry and concluded there is nothing here to detect that a sibling technique does not already cover.
This is the parent-versus-child split the sub-techniques exist to make, and all three children are already published in this corpus: T1001.001 (Junk Data) as a DNS query with an abnormally long leftmost label on {category: dns_query, product: windows}, T1001.002 (Steganography) as execution of a dedicated embedding tool on {category: process_creation, product: linux}, and T1001.003 (Protocol Impersonation) as curl or wget overriding the Host header on the same Linux process-creation source. Each of those works only because the child names a concrete mechanism that lands in one field of one event; obfuscation in general does not, and DET0053's two analytics confirm it by defining the parent purely in terms of volume and baseline. […]
What the technique is
Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Read it on attack.mitre.orgWhat MITRE says you would watch
- AN0144
Detects excessive outbound traffic to remote host over HTTP(S) from uncommon or previously unseen processes.
- AN0145
Identifies custom or previously unseen userland processes initiating high-volume HTTP connections with low response volume.
- AN0146
Flags unexpected user applications initiating long-lived HTTP(S) sessions with irregular traffic patterns.
Technique names and descriptions © MITRE ATT&CK®, CC BY 4.0. Not endorsed by MITRE.