// MITRE ATT&CK

T1001.001 · Junk Data

🎯 Command and Control ESXiLinuxmacOSWindows Sub-technique

Sub-technique of T1001 · Data Obfuscation.

Adversaries may add junk data to protocols used for command and control to make detection more difficult.(Citation: FireEye SUNBURST Backdoor December 2020) By adding random or meaningless data to the protocols used for command and control, adversaries can prevent trivial methods for decoding, decip...

How to detect & mitigate it

Detecting Junk Data starts with your SIEM/EDR telemetry. Write a detection rule with the Sigma generator, analyze suspicious logs in the log analyzer, and place the technique on your coverage with the ATT&CK matrix.

Related techniques

Source: MITRE ATT&CK®. ATT&CK is a registered trademark of The MITRE Corporation. Content for educational purposes.