{"source_checked_on":"2026-10-19","schema_version":1,"key":"enterprise/T1001","id":"T1001","name":"Data Obfuscation","domain":"enterprise","reviewed_on":"2026-09-28","source_url":"https://attack.mitre.org/techniques/T1001","source_file":{"file":"enterprise.json","url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/20664a889568dce884a1dac0ec7b12ae3a199f51/enterprise-attack/enterprise-attack-20.0.json","sha256":"81113ba98afa2928f3dcff62022539f7ce30c315c32e14422f11ff95ce534352","bytes":55271014},"source_object_sha256":"6f8b5a06e9f7e03aa0b31ae9183bc092c3593f1749bea34d55f97c967c2b572a","description":"Adversaries may obfuscate command and control traffic to make it more difficult to detect.(Citation: Bitdefender FunnyDream Campaign November 2020) Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols. ","references":[{"source_name":"mitre-attack","url":"https://attack.mitre.org/techniques/T1001","external_id":"T1001"},{"source_name":"University of Birmingham C2","description":"Gardiner, J.,  Cova, M., Nagaraja, S. (2014, February). Command & Control Understanding, Denying and Detecting. Retrieved September 3, 2026.","url":"https://arxiv.org/pdf/1408.1136"},{"source_name":"Bitdefender FunnyDream Campaign November 2020","description":"Vrabie, V. (2020, November). Dissecting a Chinese APT Targeting South Eastern Asian Government Institutions. Retrieved September 19, 2022.","url":"https://www.bitdefender.com/files/News/CaseStudies/study/379/Bitdefender-Whitepaper-Chinese-APT.pdf"}],"platforms":["ESXi","Linux","macOS","Windows"],"environments":["cloud-hosted-endpoint","onprem","virtualization"],"visibility":"source_mapped","visibility_note":null,"parent":null,"children":[{"key":"enterprise/T1001.001","id":"T1001.001","name":"Junk Data","page":"techniques/enterprise/T1001.001/"},{"key":"enterprise/T1001.002","id":"T1001.002","name":"Steganography","page":"techniques/enterprise/T1001.002/"},{"key":"enterprise/T1001.003","id":"T1001.003","name":"Protocol or Service Impersonation","page":"techniques/enterprise/T1001.003/"}],"telemetry":[{"id":"DC0082","name":"Network Connection Creation","page":"telemetry/DC0082/","kind":"attack_component","category":"Endpoint activity","description":"Creation of an endpoint network connection linked to a process.","collection_focus":"Enable scoped Sysmon NetworkConnect (3), disabled by default, or a platform-equivalent process-aware network sensor.","providers":[{"name":"Microsoft Sysmon","scope":"Windows event-based collection; enable the event types needed below.","source_id":"sysmon"},{"name":"Linux Audit","scope":"Linux alternative for supported system-call and file events; different semantics and fields.","source_id":"linux"},{"name":"Apple Endpoint Security clients","scope":"macOS alternative where the subscribed event exists; requires an entitled, approved client, not an iOS collector.","source_id":"apple"}],"configuration":["On a disposable Windows host, review the installed Sysmon schema and current configuration; merge scoped event filters into the existing policy rather than replacing it.","Forward Microsoft-Windows-Sysmon/Operational to the lab collector. Preserve event ID, timestamp, computer, process identifiers and the original event.","For Linux or macOS, select the equivalent sensor separately and test its emitted fields; a Windows event ID does not transfer across platforms."],"configuration_example":null,"required_fields":["process_guid","destination_ip","destination_port","protocol","initiated"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0082","collector":"illustrative-lab-collector","observation":{"process_guid":"lab-process-001","destination_ip":"198.51.100.20","destination_port":443,"protocol":"tcp","initiated":true}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Event filtering and sensor versions change coverage. High-volume image-load and process-access collection needs tuning; endpoint events alone do not establish intent.","sources":[{"id":"sysmon","title":"Microsoft Sysmon events and configuration","url":"https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon"},{"id":"sysmon_config","title":"Microsoft Sysmon configuration files","url":"https://learn.microsoft.com/en-us/windows/security/operating-system-security/sysmon/sysmon-configuration-files"},{"id":"linux","title":"Linux Audit rule configuration","url":"https://www.man7.org/linux/man-pages/man8/auditctl.8.html"},{"id":"apple","title":"Apple Endpoint Security framework for macOS","url":"https://developer.apple.com/documentation/endpointsecurity"},{"id":"process_audit","title":"Microsoft process creation event 4688","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4688"}],"association":"attack_component","anomaly_design":"Per host role and user: rare process/object combinations, bursts of object access or modification, and ordered parent/action sequences. Compare maintenance windows and signed software rollout activity."},{"id":"DC0085","name":"Network Traffic Content","page":"telemetry/DC0085/","kind":"attack_component","category":"Network and protocol telemetry","description":"Packet or decoded application-protocol content visible at a network sensor.","collection_focus":"Scope approved packet capture/protocol content collection to the lab flow; retain capture provenance and truncation indicators.","providers":[{"name":"Zeek","scope":"Connection and protocol metadata from traffic visible to the sensor.","source_id":"zeek"},{"name":"Suricata EVE","scope":"Configured flow, alert, DNS, HTTP, TLS and protocol records.","source_id":"suricata"}],"configuration":["Use an authorized lab TAP/SPAN, virtual mirror or gateway interface. Define which traffic crosses it; avoid assuming visibility into every segment.","Enable the required Zeek analyzers or Suricata EVE event types. Export logs with sensor identity, clock synchronization and flow correlation identifiers.","Monitor capture loss, truncation and exporter sampling. Capture payload only with approval and restrictive retention; encryption normally prevents plaintext inspection."],"configuration_example":null,"required_fields":["flow_id","protocol","method","path","payload_excerpt"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0085","collector":"illustrative-lab-collector","observation":{"flow_id":"lab-flow-1","protocol":"http","method":"GET","path":"/lab-check","payload_excerpt":"LAB_TELEMETRY_CHECK"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Flows are not packet payloads. NAT, asymmetric routes, encryption, missing mirrors and sampling can hide attribution or content. A destination connection alone does not prove malicious intent.","sources":[{"id":"zeek","title":"Zeek protocol and connection logs","url":"https://docs.zeek.org/en/current/reference/logs/index.html"},{"id":"zeek_start","title":"Zeek capture setup","url":"https://docs.zeek.org/en/current/quickstart.html"},{"id":"suricata","title":"Suricata EVE JSON output","url":"https://docs.suricata.io/en/latest/output/eve/eve-json-output.html"}],"association":"attack_component","anomaly_design":"Per source and observation point: connection rate, destination-host/port fan-out, response/failure ratio and previously unseen destinations. Compare equivalent time windows; separate authorized scanners, NAT and sampling effects."},{"id":"DC0032","name":"Process Creation","page":"telemetry/DC0032/","kind":"attack_component","category":"Endpoint activity","description":"Creation of a process with executable, command line, parent and security context.","collection_focus":"Collect Sysmon ProcessCreate (1); preserve ProcessGuid and parent identifiers. Security 4688 is an alternative with separate audit/command-line settings.","providers":[{"name":"Microsoft Sysmon","scope":"Windows event-based collection; enable the event types needed below.","source_id":"sysmon"},{"name":"Linux Audit","scope":"Linux alternative for supported system-call and file events; different semantics and fields.","source_id":"linux"},{"name":"Apple Endpoint Security clients","scope":"macOS alternative where the subscribed event exists; requires an entitled, approved client, not an iOS collector.","source_id":"apple"}],"configuration":["On a disposable Windows host, review the installed Sysmon schema and current configuration; merge scoped event filters into the existing policy rather than replacing it.","Forward Microsoft-Windows-Sysmon/Operational to the lab collector. Preserve event ID, timestamp, computer, process identifiers and the original event.","For Linux or macOS, select the equivalent sensor separately and test its emitted fields; a Windows event ID does not transfer across platforms."],"configuration_example":{"label":"Sysmon filter fragment · merge into the reviewed lab configuration","language":"xml","source_id":"sysmon_config","content":"<EventFiltering>\n  <ProcessCreate onmatch=\"include\">\n    <Image condition=\"is\">C:\\Windows\\System32\\whoami.exe</Image>\n  </ProcessCreate>\n</EventFiltering>","note":"This fragment only selects the named process. It is not a complete production policy. Inspect the installed schema with sysmon64 -s; preserve existing rules, then apply the reviewed complete configuration with sysmon64 -c <configuration-file>."},"required_fields":["process_guid","image","parent_image","command_line","user"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0032","collector":"illustrative-lab-collector","observation":{"process_guid":"lab-process-001","image":"C:\\Windows\\System32\\whoami.exe","parent_image":"C:\\Windows\\System32\\cmd.exe","command_line":"whoami","user":"LAB\\analyst"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Event filtering and sensor versions change coverage. High-volume image-load and process-access collection needs tuning; endpoint events alone do not establish intent.","sources":[{"id":"sysmon","title":"Microsoft Sysmon events and configuration","url":"https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon"},{"id":"sysmon_config","title":"Microsoft Sysmon configuration files","url":"https://learn.microsoft.com/en-us/windows/security/operating-system-security/sysmon/sysmon-configuration-files"},{"id":"linux","title":"Linux Audit rule configuration","url":"https://www.man7.org/linux/man-pages/man8/auditctl.8.html"},{"id":"apple","title":"Apple Endpoint Security framework for macOS","url":"https://developer.apple.com/documentation/endpointsecurity"},{"id":"process_audit","title":"Microsoft process creation event 4688","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4688"}],"association":"attack_component","anomaly_design":"Per host role and user: rare process/object combinations, bursts of object access or modification, and ordered parent/action sequences. Compare maintenance windows and signed software rollout activity."}],"detection":{"key":"enterprise/T1001","id":"T1001","name":"Data Obfuscation","domain":"enterprise","platforms":["ESXi","Linux","macOS","Windows"],"environments":["cloud-hosted-endpoint","onprem","virtualization"],"source_url":"https://attack.mitre.org/techniques/T1001","technique_page":"techniques/enterprise/T1001/","page":"detections/enterprise/T1001/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":3,"live_validated":0},"sigma_rules":[],"atlas_basic":[],"atlas_anomaly":[],"anomaly_types":[],"strategies":[{"id":"DET0053","name":"Detect Obfuscated C2 via Network Traffic Analysis","url":"https://attack.mitre.org/detectionstrategies/DET0053","stix_id":"x-mitre-detection-strategy--e17b2809-7534-4749-9bd8-95fdb24e4891","relationship_id":"relationship--7ed4c50d-fb81-4d1b-b89f-6a8d81994887","description":"","analytics":[{"id":"AN0144","name":"Analytic 0144","guidance":"Detects excessive outbound traffic to remote host over HTTP(S) from uncommon or previously unseen processes.","url":"https://attack.mitre.org/detectionstrategies/DET0053#AN0144","platforms":["Windows"],"tuning":[{"field":"OutboundByteThreshold","description":"Defines threshold ratio of outbound to inbound bytes that signals possible obfuscation"},{"field":"ProcessAllowlist","description":"List of known legitimate network clients to exclude from anomaly checks"}],"log_sources":[{"component_id":"DC0085","component":"Network Traffic Content","name":"NSM:Flow","channel":"HTTP ","platforms":["Windows"],"analytic_id":"AN0144","source_url":"https://attack.mitre.org/detectionstrategies/DET0053#AN0144","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0085/"}]},{"id":"AN0145","name":"Analytic 0145","guidance":"Identifies custom or previously unseen userland processes initiating high-volume HTTP connections with low response volume.","url":"https://attack.mitre.org/detectionstrategies/DET0053#AN0145","platforms":["Linux"],"tuning":[{"field":"UserProcessBaseline","description":"Defines what is considered abnormal for a user-initiated process context"}],"log_sources":[{"component_id":"DC0082","component":"Network Connection Creation","name":"auditd:SYSCALL","channel":"connect","platforms":["Linux"],"analytic_id":"AN0145","source_url":"https://attack.mitre.org/detectionstrategies/DET0053#AN0145","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0082/"}]},{"id":"AN0146","name":"Analytic 0146","guidance":"Flags unexpected user applications initiating long-lived HTTP(S) sessions with irregular traffic patterns.","url":"https://attack.mitre.org/detectionstrategies/DET0053#AN0146","platforms":["macOS"],"tuning":[{"field":"SessionDuration","description":"Session length that exceeds average per-user expectations"}],"log_sources":[{"component_id":"DC0085","component":"Network Traffic Content","name":"macos:unifiedlog","channel":"network flow","platforms":["macOS"],"analytic_id":"AN0146","source_url":"https://attack.mitre.org/detectionstrategies/DET0053#AN0146","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0085/"},{"component_id":"DC0032","component":"Process Creation","name":"macos:unifiedlog","channel":"process","platforms":["macOS"],"analytic_id":"AN0146","source_url":"https://attack.mitre.org/detectionstrategies/DET0053#AN0146","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0032/"}]}]}],"telemetry_references":[{"id":"DC0082","name":"Network Connection Creation","tag":"Network Connection Creation","page":"telemetry/DC0082/","kind":"attack_component"},{"id":"DC0085","name":"Network Traffic Content","tag":"Network Traffic Content","page":"telemetry/DC0085/","kind":"attack_component"},{"id":"DC0032","name":"Process Creation","tag":"Process Creation","page":"telemetry/DC0032/","kind":"attack_component"}],"visibility":"source_mapped","visibility_note":null,"tool_references":[{"id":"S9003","name":"evilginx2","page":"tools/S9003/","kind":"attack_tool","bases":["attack_uses"],"guides":[]}],"related_parent":null,"article_url":"https://1200km.com/articles/read/2026/2026-04-20-malicious-activity-as-a-statistical-signal-a-detection-engineering-analysis-of-anomaly-bas-90df8b6dea12/","validation":{"source_join":"exact_ids","sigma_yaml":"parsed","backend_compilation":"not_run","live_telemetry":"not_run","detection_execution":"not_run"}},"tools":[{"id":"S9003","name":"evilginx2","page":"tools/S9003/","kind":"attack_tool","bases":["attack_uses"],"guides":[]}],"software":[{"id":"S0381","name":"FlawedAmmyy","url":"https://attack.mitre.org/software/S0381","kind":"malware","description":"[FlawedAmmyy](https://attack.mitre.org/software/S0381) may obfuscate portions of the initial C2 handshake.(Citation: Proofpoint TA505 Mar 2018)","relationship_id":"relationship--efd7f218-0e23-458b-be17-afad9545fa25","references":[{"source_name":"Proofpoint TA505 Mar 2018","description":"Proofpoint Staff. (2018, March 7). Leaked Ammyy Admin Source Code Turned into Malware. Retrieved May 28, 2019.","url":"https://www.proofpoint.com/us/threat-insight/post/leaked-ammyy-admin-source-code-turned-malware"}]},{"id":"S0439","name":"Okrum","url":"https://attack.mitre.org/software/S0439","kind":"malware","description":"Okrum leverages the HTTP protocol for C2 communication, while hiding the actual messages in the Cookie and Set-Cookie headers of the HTTP requests.(Citation: ESET Okrum July 2019)","relationship_id":"relationship--3bca1b9e-c598-494a-9471-0121734e7c79","references":[{"source_name":"ESET Okrum July 2019","description":"Hromcova, Z. (2019, July). OKRUM AND KETRICAN: AN OVERVIEW OF RECENT KE3CHANG GROUP ACTIVITY. Retrieved May 6, 2020.","url":"https://www.welivesecurity.com/wp-content/uploads/2019/07/ESET_Okrum_and_Ketrican.pdf"}]},{"id":"S0495","name":"RDAT","url":"https://attack.mitre.org/software/S0495","kind":"malware","description":"[RDAT](https://attack.mitre.org/software/S0495) has used encoded data within subdomains as AES ciphertext to communicate from the host to the C2.(Citation: Unit42 RDAT July 2020)","relationship_id":"relationship--dd4423f6-b526-4856-aa00-2c4aa36617da","references":[{"source_name":"Unit42 RDAT July 2020","description":"Falcone, R. (2020, July 22). OilRig Targets Middle Eastern Telecommunications Organization and Adds Novel C2 Channel with Steganography to Its Inventory. Retrieved July 28, 2020.","url":"https://unit42.paloaltonetworks.com/oilrig-novel-c2-channel-steganography/"}]},{"id":"S0533","name":"SLOTHFULMEDIA","url":"https://attack.mitre.org/software/S0533","kind":"malware","description":"[SLOTHFULMEDIA](https://attack.mitre.org/software/S0533) has hashed a string containing system information prior to exfiltration via POST requests.(Citation: CISA MAR SLOTHFULMEDIA October 2020)","relationship_id":"relationship--6d182b64-121f-43bf-b268-fe1e5874087d","references":[{"source_name":"CISA MAR SLOTHFULMEDIA October 2020","description":"DHS/CISA, Cyber National Mission Force. (2020, October 1). Malware Analysis Report (MAR) MAR-10303705-1.v1 – Remote Access Trojan: SLOTHFULMEDIA. Retrieved October 2, 2020.","url":"https://us-cert.cisa.gov/ncas/analysis-reports/ar20-275a"}]},{"id":"S0610","name":"SideTwist","url":"https://attack.mitre.org/software/S0610","kind":"malware","description":"[SideTwist](https://attack.mitre.org/software/S0610) can embed C2 responses in the source code of a fake Flickr webpage.(Citation: Check Point APT34 April 2021)","relationship_id":"relationship--f0782cdb-1b7a-4e23-acb4-dba55ad03468","references":[{"source_name":"Check Point APT34 April 2021","description":"Check Point. (2021, April 8). Iran’s APT34 Returns with an Updated Arsenal. Retrieved May 5, 2021.","url":"https://research.checkpoint.com/2021/irans-apt34-returns-with-an-updated-arsenal/"}]},{"id":"S0682","name":"TrailBlazer","url":"https://attack.mitre.org/software/S0682","kind":"malware","description":"[TrailBlazer](https://attack.mitre.org/software/S0682) can masquerade its C2 traffic as legitimate Google Notifications HTTP requests.(Citation: CrowdStrike StellarParticle January 2022)","relationship_id":"relationship--7bade69a-16f3-4d2d-bec5-c7dc76358787","references":[{"source_name":"CrowdStrike StellarParticle January 2022","description":"CrowdStrike. (2022, January 27). Early Bird Catches the Wormhole: Observations from the StellarParticle Campaign. Retrieved February 7, 2022.","url":"https://www.crowdstrike.com/blog/observations-from-the-stellarparticle-campaign/"}]},{"id":"S1044","name":"FunnyDream","url":"https://attack.mitre.org/software/S1044","kind":"malware","description":"[FunnyDream](https://attack.mitre.org/software/S1044) can send compressed and obfuscated packets to C2.(Citation: Bitdefender FunnyDream Campaign November 2020)","relationship_id":"relationship--d0ce49aa-fc45-431a-8109-90958fb15b5e","references":[{"source_name":"Bitdefender FunnyDream Campaign November 2020","description":"Vrabie, V. (2020, November). Dissecting a Chinese APT Targeting South Eastern Asian Government Institutions. Retrieved September 19, 2022.","url":"https://www.bitdefender.com/files/News/CaseStudies/study/379/Bitdefender-Whitepaper-Chinese-APT.pdf"}]},{"id":"S1100","name":"Ninja","url":"https://attack.mitre.org/software/S1100","kind":"malware","description":"[Ninja](https://attack.mitre.org/software/S1100) has the ability to modify headers and URL paths to hide malicious traffic in HTTP requests.(Citation: Kaspersky ToddyCat June 2022)","relationship_id":"relationship--784ac574-4c0d-485e-ae56-63d3b88e383f","references":[{"source_name":"Kaspersky ToddyCat June 2022","description":"Dedola, G. (2022, June 21). APT ToddyCat. Retrieved January 3, 2024.","url":"https://securelist.com/toddycat/106799/"}]},{"id":"S1111","name":"DarkGate","url":"https://attack.mitre.org/software/S1111","kind":"malware","description":"[DarkGate](https://attack.mitre.org/software/S1111) will retrieved encrypted commands from its command and control server for follow-on actions such as cryptocurrency mining.(Citation: Ensilo Darkgate 2018)","relationship_id":"relationship--d8c84ee1-db8d-4f32-addf-831310c93ab7","references":[{"source_name":"Ensilo Darkgate 2018","description":"Adi Zeligson & Rotem Kerner. (2018, November 13). Enter The DarkGate - New Cryptocurrency Mining and Ransomware Campaign. Retrieved February 9, 2024.","url":"https://www.fortinet.com/blog/threat-research/enter-the-darkgate-new-cryptocurrency-mining-and-ransomware-campaign"}]},{"id":"S1120","name":"FRAMESTING","url":"https://attack.mitre.org/software/S1120","kind":"malware","description":"[FRAMESTING](https://attack.mitre.org/software/S1120) can send and receive zlib compressed data within `POST` requests.(Citation: Mandiant Cutting Edge Part 2 January 2024)","relationship_id":"relationship--db5014cf-3281-493d-8416-9385737cf12d","references":[{"source_name":"Mandiant Cutting Edge Part 2 January 2024","description":"Lin, M. et al. (2024, January 31). Cutting Edge, Part 2: Investigating Ivanti Connect Secure VPN Zero-Day Exploitation. Retrieved February 27, 2024.","url":"https://www.mandiant.com/resources/blog/investigating-ivanti-zero-day-exploitation"}]},{"id":"S1183","name":"StrelaStealer","url":"https://attack.mitre.org/software/S1183","kind":"malware","description":"[StrelaStealer](https://attack.mitre.org/software/S1183) encrypts the payload of HTTP POST communications using the same XOR key used for the malware's DLL payload.(Citation: DCSO StrelaStealer 2022)","relationship_id":"relationship--09388627-d275-4b74-bcd4-d8643d3e0482","references":[{"source_name":"DCSO StrelaStealer 2022","description":"DCSO CyTec Blog. (2022, November 8). #ShortAndMalicious: StrelaStealer aims for mail credentials. Retrieved December 31, 2024.","url":"https://medium.com/@DCSO_CyTec/shortandmalicious-strelastealer-aims-for-mail-credentials-a4c3e78c8abc"}]},{"id":"S9001","name":"SystemBC","url":"https://attack.mitre.org/software/S9001","kind":"malware","description":"[SystemBC](https://attack.mitre.org/software/S9001) has encoded with XOR and encrypted with RC4 its beacon.(Citation: Lumen_SystemBC_Sept2025)","relationship_id":"relationship--4802a823-0a51-47c2-aabe-369a2430ba95","references":[{"source_name":"Lumen_SystemBC_Sept2025","description":"Black Lotus Labs . (2025, September 18). SystemBC: Bringing the noise. Retrieved December 15, 2025.","url":"https://blog.lumen.com/systembc-bringing-the-noise/"}]},{"id":"S9003","name":"evilginx2","url":"https://attack.mitre.org/software/S9003","kind":"tool","description":"[evilginx2](https://attack.mitre.org/software/S9003) can modify the Origin and Referrer fields in HTTPS headers it relays between intended victims and legitimate websites to comply with cross-origin resource sharing (CORS) restrictions.(Citation: Evilginx 2 July 2018)","relationship_id":"relationship--dc27cb61-8dcf-4cc6-b166-b6faf6504c21","references":[{"source_name":"Evilginx 2 July 2018","description":"Gretzky, K.. (2018, July 26). Evilginx 2 - Next Generation of Phishing 2FA Tokens. Retrieved October 14, 2019.","url":"https://breakdev.org/evilginx-2-next-generation-of-phishing-2fa-tokens/"}]}],"actors":[{"id":"G0047","name":"Gamaredon Group","url":"https://attack.mitre.org/groups/G0047","kind":"intrusion-set","description":"[Gamaredon Group](https://attack.mitre.org/groups/G0047) has used obfuscated VBScripts with randomly generated variable names and concatenated strings.(Citation: unit42_gamaredon_dec2022) ","relationship_id":"relationship--0e2c026d-042b-4ccb-b2d1-8ca6308ea506","references":[{"source_name":"unit42_gamaredon_dec2022","description":"Unit 42. (2022, December 20). Russia’s Trident Ursa (aka Gamaredon APT) Cyber Conflict Operations Unwavering Since Invasion of Ukraine. Retrieved September 12, 2024.","url":"https://unit42.paloaltonetworks.com/trident-ursa/"}]}],"mitigations":[{"id":"M1031","name":"Network Intrusion Prevention","url":"https://attack.mitre.org/mitigations/M1031","kind":"course-of-action","description":"Network intrusion detection and prevention systems that use network signatures to identify traffic for specific adversary malware can be used to mitigate some obfuscation activity at the network level.","relationship_id":"relationship--82cf0b15-1cd0-4539-b3fe-63ee4d379113","references":[]}],"candidates":[],"simulation":{"atomic_status":"no_atomic_candidate","lab_execution":"not_run","browser_attack_runner":false,"prerequisites":"Use disposable lab hosts and test accounts, explicit target allowlists, a clean snapshot, bounded egress and a restore plan. Review every candidate and dependency before any execution.","scenario":null},"validation":{"source_identity":"checked_against_pinned_source","relationship_join":"exact_ids_no_inheritance","page_contract":"automated_checks_required","sensor_capture":"not_run","detection_backend":"not_run","adversary_simulation":"not_run","independent_incident_fact_check":"not_performed"},"technique_links":{"T1001":"/ttp-simulation/techniques/enterprise/T1001/"},"synthetic":{"schema":"1200km.ttp.collection-fixture.v1","synthetic":true,"technique_key":"enterprise/T1001","purpose":"Collection/parser contract exercise, NOT a positive example or detection of this TTP.","events":[{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0082","collector":"illustrative-lab-collector","observation":{"process_guid":"lab-process-001","destination_ip":"198.51.100.20","destination_port":443,"protocol":"tcp","initiated":true}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0085","collector":"illustrative-lab-collector","observation":{"flow_id":"lab-flow-1","protocol":"http","method":"GET","path":"/lab-check","payload_excerpt":"LAB_TELEMETRY_CHECK"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0032","collector":"illustrative-lab-collector","observation":{"process_guid":"lab-process-001","image":"C:\\Windows\\System32\\whoami.exe","parent_image":"C:\\Windows\\System32\\cmd.exe","command_line":"whoami","user":"LAB\\analyst"}}]}}