Sub-technique of T1001 Data Obfuscation.View on attack.mitre.org
Adversaries may impersonate legitimate protocols or web service traffic to disguise command and control activity and thwart analysis efforts. By impersonating legitimate protocols or web services, adversaries can make their command and control traffic blend in with legitimate network traffic.
Adversaries may impersonate a fake SSL/TLS handshake to make it look like subsequent traffic is SSL/TLS encrypted, potentially interfering with some security tooling, or to make the traffic look like it is related with a trusted entity.
Adversaries may also leverage legitimate protocols to impersonate expected web traffic or trusted services. For example, adversaries may manipulate HTTP headers, URI endpoints, SSL certificates, and transmitted data to disguise C2 communications or mimic legitimate services such as Gmail, Google Drive, and Yahoo Messenger.
Rules on DetectionCode tagged with T1001.003.
| Rule | Level | Log source |
|---|---|---|
| Suspicious LDAP-Attributes Used | high | windows / NULL |
| ADSI-Cache File Creation By Uncommon Tool | medium | windows / file_event |
| Used by | Procedure example |
|---|---|
| GroupHigaisa | Higaisa used a FakeTLS session for C2 communications. |
| GroupLazarus Group | Lazarus Group malware also uses a unique form of communication encryption known as FakeTLS that mimics TLS but uses a different encryption method, potentially evading SSL traffic inspection/decryption. |
| GroupMustang Panda | Mustang Panda has utilized TLS record headers in network packets to impersonate various versions of TLS protocols to blend in with legitimate network traffic. Mustang Panda has used FakeTLS to communicate with its C2 servers. |
| Used by | Procedure example |
|---|---|
| MalwareBADCALL | BADCALL uses a FakeTLS method during C2. |
| MalwareBankshot | Bankshot generates a false TLS handshake using a public certificate to disguise C2 network communications. |
| MalwareBOOKWORM | BOOKWORM has modified HTTP POST requests to resemble legitimate communications. |
| MalwareCobalt Strike | Cobalt Strike can leverage the HTTP protocol for C2 communication, while hiding the actual data in either an HTTP header, URI parameter, the transaction body, or appending it to the URI. Cobalt Strike has also added Host: ocsp.verisign.com to HTTP headers to mimic Online Certificate Status Protocol (OCSP) traffic. |
| MalwareFakeM | FakeM C2 traffic attempts to evade detection by resembling data generated by legitimate messenger applications, such as MSN and Yahoo! messengers. Additionally, some variants of FakeM use modified SSL code for communications back to C2 servers, making SSL decryption ineffective. |
| MalwareFALLCHILL | FALLCHILL uses fake Transport Layer Security (TLS) to communicate with its C2 server. |
| MalwareFRAMESTING | FRAMESTING uses a cookie named `DSID` to mimic the name of a cookie used by Ivanti Connect Secure appliances for maintaining VPN sessions. |
| MalwareHARDRAIN | HARDRAIN uses FakeTLS to communicate with its C2 server. |
Data from MITRE ATT&CK® (Enterprise). ATT&CK® is a registered trademark of The MITRE Corporation.
