Home
ATT&CK Techniques
T1001.001 Junk Data

T1001.001 Junk Data Mappings

Adversaries may add junk data to protocols used for command and control to make detection more difficult. By adding random or meaningless data to the protocols used for command and control, adversaries can prevent trivial methods for decoding, deciphering, or otherwise analyzing the traffic. Examples may include appending/prepending data with junk characters or writing junk characters between significant characters.

View in MITRE ATT&CK®

Mappings

Capability ID	Capability Description	Mapping Type	ATT&CK ID	ATT&CK Name
AC-4	Information Flow Enforcement	Protects	T1001.001	Junk Data
CA-7	Continuous Monitoring	Protects	T1001.001	Junk Data
CM-2	Baseline Configuration	Protects	T1001.001	Junk Data
CM-6	Configuration Settings	Protects	T1001.001	Junk Data
SC-7	Boundary Protection	Protects	T1001.001	Junk Data
SI-3	Malicious Code Protection	Protects	T1001.001	Junk Data
SI-4	System Monitoring	Protects	T1001.001	Junk Data
action.hacking.variety.Evade Defenses	Modification of the action (rather than the system, as in 'Disable controls') to avoid detection.	related-to	T1001.001	Data Obfuscation: Junk Data
action.malware.variety.Backdoor or C2	Malware creates a remote control capability, but it's unclear if it's a backdoor for hacking or C2 for malware. Parent of 'C2' and 'Backdoor'.	related-to	T1001.001	Data Obfuscation: Junk Data
action.malware.variety.C2	Malware creates Command and Control capability for malware. Child of 'Backdoor or C2'.	related-to	T1001.001	Data Obfuscation: Junk Data
action.malware.variety.Unknown	Unknown	related-to	T1001.001	Data Obfuscation: Junk Data