Data Obfuscation: Junk Data

Adversaries may add junk data to protocols used for command and control to make detection more difficult. By adding random or meaningless data to the protocols used for command and control, adversaries can prevent trivial methods for decoding, deciphering, or otherwise analyzing the traffic. Examples may include appending/prepending data with junk characters or writing junk characters between significant characters.

ID: T1001.001
Sub-technique of:  T1001
Tactic: Command And Control
Platforms: Linux, Windows, macOS
Data Sources: Network protocol analysis, Packet capture, Process monitoring, Process use of network
Version: 1.0
Created: 15 March 2020
Last Modified: 15 March 2020

Procedure Examples

Name Description
APT28

APT28 added "junk data" to each encoded string, preventing trivial decoding without knowledge of the junk removal algorithm. Each implant was given a "junk length" value when created, tracked by the controller software to allow seamless communication but prevent analysis of the command protocol on the wire.[4]

Downdelph

Downdelph inserts pseudo-random characters between each original character during encoding of C2 network requests, making it difficult to write signatures on them.[1]

P2P ZeuS

P2P ZeuS added junk data to outgoing UDP packets to peer implants.[2]

PLEAD

PLEAD samples were found to be highly obfuscated with junk code.[3]

Mitigations

Mitigation Description
Network Intrusion Prevention

Network intrusion detection and prevention systems that use network signatures to identify traffic for specific adversary malware can be used to mitigate some obfuscation activity at the network level.

Detection

Analyze network data for uncommon data flows (e.g., a client sending significantly more data than it receives from a server). Processes utilizing the network that do not normally have network communication or have never been seen before are suspicious. Analyze packet contents to detect communications that do not follow the expected protocol behavior for the port that is being used.[5]

References