Adversaries may manipulate network traffic in order to hide and evade detection of their C2 infrastructure. This can be accomplished by identifying and filtering traffic from defensive tools,[1] masking malicious domains to obfuscate the true destination from both automated scanning tools and security researchers,[2][3][4] and otherwise hiding malicious artifacts to delay discovery and prolong the effectiveness of adversary infrastructure that could otherwise be identified, blocked, or taken down entirely.
2 groups have been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.
Has utilized an ORB (operational relay box) network – consisting compromised devices such as small office and home office (SOHO) routers, IoT devices, and leased virtual private servers (VPS) – to obfuscate the origin of C2 traffic.1
Uses compromised residential endpoints, typically within the same ISP IP address range, as proxies to hide the true source of C2 traffic.1
All 2 groups for this technique
3 campaigns have been recorded using this technique. Listed newest first; dates are year-granularity and attribution is MITRE’s.
During Operation Digital Eye, threat actors used public Cloud infrastructure to mask malicious activity.1
Has rotated the compromised SOHO IPs used in password spraying activity to hamper detection and network blocking activities by defenders.1
During the SolarWinds Compromise, APT29 set the hostnames of their C2 infrastructure to match legitimate hostnames in the victim environment. They also used IP addresses originating from the same country as the victim for their VPN infrastructure.1
All 3 campaigns for this technique
3 software entries are documented implementing this technique. MITRE files each as a tool or as malware; newest first, then by how many groups carry them.
Can use a chain of jump hosts to communicate with compromised devices to obscure actor infrastructure.1
Attempts to retrieve a non-existent webpage from the command and control server resulting in hidden commands sent via resulting error messages.1
Command and control includes hard-coded domains in the malware masquerading as legitimate services such as Akamai CDN or Amazon Web Services.1
All 3 software entries for this technique
Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.
MITRE names one behaviour worth catching for this technique and breaks it into 5 analytics, one per platform. Each carries the log sources it needs and the fields you tune per environment.
AN1148 · Windows
Monitor DNS queries, proxy logs, and user-agent strings for anomalous patterns associated with adversary attempts to hide infrastructure. Defenders may observe DNS resolutions to short-lived domains, abnormal WHOIS registration data, or filtering of known defensive/responder IP addresses.
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Network Connection CreationDC0082 | WinEventLog:Security | EventCode=5156, 5157 |
| Domain RegistrationDC0101 | dns:query | Excessive lookups for domains with suspicious WHOIS or short TTL values |
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| SuspiciousDomains | List of domains registered with privacy-protected or suspicious WHOIS metadata. |
| ResponderIPs | Known incident response or scanning infrastructure IP ranges. |
AN1149 · Linux
Detect adversaries filtering traffic or modifying server responses to evade scanning. Monitor iptables, nftables, or proxy configurations that deny or redirect requests from known scanning agents or defensive tools.
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Process CreationDC0032 | auditd:SYSCALL | execve: Execution of commands modifying iptables/nftables to block selective IPs |
| Response MetadataDC0106 | NSM:Flow | Altered response metadata or blocked content based on user-agent or geolocation |
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| BlockedAgents | User-agent strings or scanning tools to monitor for selective filtering. |
AN1150 · macOS
Monitor unified logs for manipulation of proxy configurations, DNS resolution, or filtering rules. Adversaries may redirect responses or use trusted domains that later resolve to malicious C2 infrastructure.
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Process CreationDC0032 | macos:unifiedlog | System process modifications altering DNS/proxy settings |
| Response ContentDC0104 | NSM:Flow | Suspicious changes in TLS certificate responses or redirected domains |
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| TrustedHostingProviders | Known hosting/CDN providers often abused to hide malicious C2 infrastructure. |
AN1151 · Network Devices
Inspect network telemetry for adversary attempts to blend malicious traffic with legitimate flows using VPNs, proxies, or geolocation spoofing. Defensive teams may observe anomalous tunnels, encrypted sessions to suspicious domains, or geo-mismatched IP activity.
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Network Traffic ContentDC0085 | NSM:Flow | Encrypted tunnels or proxy traffic to non-standard destinations |
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| GeoIPRanges | Regions to monitor for unexpected or mismatched geolocation activity. |
AN1152 · ESXi
Monitor VM-level DNS and network traffic logs for adversary-controlled domains or selective response behavior (e.g., dropped requests from security scanners).
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Network Traffic ContentDC0085 | esxi:vmkernel | Suspicious traffic filtered or redirected by VM networking stack |
| Domain RegistrationDC0101 | esxi:vmkernel | DNS lookups resolving to domains with rapid changes in registration metadata |
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| MonitoredVMs | Targeted virtual machines where adversaries may attempt to hide C2 traffic. |
No detection rules are mapped to this technique yet.
Loading detections...
| Select | Title | Description | Category | Status | Event | Product | MITRE ATT&CK | CVEs | Severity | Author | Created | Updated | ID | Refs |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|