tfMITRE ATT&CK sub-technique

Junk Data T1001.001

Tactic: Command and Control
Platforms: ESXi, Linux, macOS, Windows
Version: 1.1
Created: 15 March 2020
Last modified: 12 May 2026

Adversaries may add junk data to protocols used for command and control to make detection more difficult.[1] By adding random or meaningless data to the protocols used for command and control, adversaries can prevent trivial methods for decoding, deciphering, or otherwise analyzing the traffic. Examples may include appending/prepending data with junk characters or writing junk characters between significant characters.

ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact

Threat groups45th pct

Threat groups45th percentile · 55% of ATT&CK techniques have more threat groups attributed.

CampaignsNone recorded

CampaignsNone recorded · 54% of ATT&CK techniques have none either.

Tools & malwareTop 20%

Tools & malware80th percentile · 80% of ATT&CK techniques have this many tools implementing them or fewer.

Detection rulesNone recorded

Detection rulesNone recorded · 33% of ATT&CK techniques have none either.

Junk Data MITRE reference T1001.001

45th pctamong all ATT&CK techniques for number of groups

1 group has been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.

APT28G0007 ↗

Added "junk data" to each encoded string, preventing trivial decoding without knowledge of the junk removal algorithm. Each implant was given a "junk length" value when created, tracked by the controller software to allow seamless communication but prevent analysis of the command protocol on the wire.1

created 2017-05-311 referenceaka IRON TWILIGHT

All 1 groups for this technique

Offense vs defense T1001.001

Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.

Junk Data detection strategy DET0011

MITRE names one behaviour worth catching for this technique and breaks it into 4 analytics, one per platform. Each carries the log sources it needs and the fields you tune per environment.

Detecting Junk Data in C2 Channels via Behavioral Analysis

Enterprise

4 platforms

AN0030 · Windows

Processes generating large outbound connections with disproportionate send/receive ratios, often to uncommon ports or hosts, potentially inserting meaningless data into protocol payloads.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Process AccessDC0035	WinEventLog:Sysmon	EventCode=10
Network Connection CreationDC0082	WinEventLog:Sysmon	EventCode=3, 22
Network Traffic ContentDC0085	NSM:Flow	TCP/UDP

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
PayloadEntropyThreshold	Tunable threshold for Shannon entropy of network payloads.
TimeWindow	Duration of outbound data transfer to evaluate disproportionate upload size.
UserContext	Filter based on user accounts allowed to generate outbound traffic.

AN0031 · Linux

Outbound traffic with anomalous payload sizes and patterns from non-networking processes, often observed via packet inspection or connection logs.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Process CreationDC0032	auditd:SYSCALL	execve network tools
Network Traffic ContentDC0085	NSM:Flow	TCP session tracking

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
EntropyScore	Adjust based on expected entropy of typical outbound data.
ProcessWhitelist	Exclude known good binaries that generate high network output.
DataRatioThreshold	Minimum ratio of bytes_sent to bytes_received.

AN0032 · macOS

Previously unseen applications generating outbound connections with atypical data flow characteristics, such as excessive data with no return response.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Process CreationDC0032	macos:osquery	process_events
Network Connection CreationDC0082	macos:unifiedlog	connection attempts
Network Traffic ContentDC0085	NSM:Flow	session behavior

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
ParentProcessCheck	Allow filtering based on parent-child relationship for benign services.
HostWhitelist	Known legitimate C2-like patterns (e.g., Apple telemetry).

AN0033 · ESXi

Anomalous traffic from ESXi host management daemons (like hostd or vpxa) embedding non-standard payloads in management protocols (e.g., HTTPS) or beaconing behavior.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Network Connection CreationDC0082	esxi:hostd	System service interactions
Network Traffic ContentDC0085	esxi:vmkernel	Network activity

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
TLSFingerprintMismatch	Detects mismatched TLS client behavior vs expected for hostd/vpxa.
UnusualDestinationPorts	Highlight traffic from ESXi hosts to uncommon ports outside vCenter ranges.

Junk Data detections T1001.001

No detection rules are mapped to this technique yet.

None recorded— 33% of ATT&CK techniques have none either

Drag headers to reorder | Drag edges to resize

Loading detections...

Select	Title	Description	Category	Status	Event	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID	Refs