Keypoints
- Adversaries alter C2 traffic to avoid signature-based detection by adding junk or changing packet structures.
- Steganography can hide commands in seemingly benign files or media to bypass network inspection.
- Protocol impersonation makes malicious traffic look like legitimate services on common ports.
- Unusual client-server data ratios and unexpected process network usage are strong indicators.
- Detection relies on deep packet inspection, behavioral baselining, and endpoint-network correlation.
Description:
- Like a spy slipping secret notes inside a newspaper, data obfuscation hides malicious commands in ordinary-looking traffic so observers miss the message.
- Adversaries modify, pad, or embed C2 communications into benign protocols or files to conceal intent; this enables remote control, data exfiltration, or command delivery while reducing detection likelihood.
Detection:
- Collect full packet captures and use deep packet inspection (DPI) to identify payload irregularities against expected protocol grammars.
- Baseline normal client-server byte ratios and alert on deviations where clients send far more or differently shaped data than usual.
- Correlate process-to-network mappings on endpoints; flag processes that rarely or never networked before when they initiate connections.
- Use flow analysis (NetFlow/IPFIX) to detect anomalous session patterns, long-lived small-packet connections, or irregular timing gaps.
- Inspect file transfers and media for steganographic content using tools like StegExpose or custom entropy analysis; watch for unusual entropy spikes.
- Monitor TLS/SSL metadata (SNI, certs, ciphers) for mismatches or reused certificates; combine with JA3/JA3S fingerprinting to spot suspicious clients/servers.
- Reduce false positives by maintaining protocol-specific parsers, applying statistical baselines, and tuning thresholds; validate alerts with endpoint process and file forensic data.
Tactics:
Command and Control
Platforms:
ESXi, Linux, Windows, macOS
Data Sources:
Network Traffic: Network Traffic Content
Relationship Citations:
(Citation: unit42_gamaredon_dec2022),(Citation: Proofpoint TA505 Mar 2018),(Citation: Bitdefender FunnyDream Campaign November 2020),(Citation: Mandiant Cutting Edge Part 2 January 2024),(Citation: FoxIT Wocao December 2019),(Citation: ESET Okrum July 2019),(Citation: Ensilo Darkgate 2018),(Citation: Kaspersky ToddyCat June 2022),(Citation: DCSO StrelaStealer 2022),(Citation: Unit42 RDAT July 2020),(Citation: CrowdStrike StellarParticle January 2022),(Citation: CISA MAR SLOTHFULMEDIA October 2020),(Citation: Check Point APT34 April 2021),
Read More: https://attack.mitre.org/techniques/T1001