Skip to content

Data Obfuscation

Technique · ATTACK:enterprise:T1001

Attributed source ↗ · Plaintext record · Complete record and assertions JSON

Inspect structured metadata and provenance

{
  "id": "ATTACK:enterprise:T1001",
  "title": "Data Obfuscation",
  "type": "Technique",
  "source_url": "https://attack.mitre.org/techniques/T1001",
  "snapshot": "enterprise-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "attack-pattern--ad255bfe-a9e6-4b52-a258-8d3462abe842",
  "external_id": "T1001",
  "domain": "enterprise",
  "created": "2017-05-31T21:30:18.931Z",
  "modified": "2026-09-03T19:46:47.930Z",
  "version": "1.2",
  "aliases": [

  ],
  "tactics": [
    "command-and-control"
  ],
  "source_references": [
    {
      "source_name": "University of Birmingham C2",
      "url": "https://arxiv.org/pdf/1408.1136"
    },
    {
      "source_name": "Bitdefender FunnyDream Campaign November 2020",
      "url": "https://www.bitdefender.com/files/News/CaseStudies/study/379/Bitdefender-Whitepaper-Chinese-APT.pdf"
    }
  ]
}

Explicit source assertions (19)

First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.

ATTACK:enterprise:S1183 → uses → ATTACK:enterprise:T1001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--09388627-d275-4b74-bcd4-d8643d3e0482

DCSO StrelaStealer 2022

ATTACK:enterprise:G0047 → uses → ATTACK:enterprise:T1001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0e2c026d-042b-4ccb-b2d1-8ca6308ea506

unit42_gamaredon_dec2022

ATTACK:enterprise:T1001.001 → subtechnique-of → ATTACK:enterprise:T1001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--38c7e0b8-3961-48ed-b5e6-c4763c212ecb

ATTACK:enterprise:S0439 → uses → ATTACK:enterprise:T1001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3bca1b9e-c598-494a-9471-0121734e7c79

ESET Okrum July 2019

ATTACK:enterprise:S9001 → uses → ATTACK:enterprise:T1001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4802a823-0a51-47c2-aabe-369a2430ba95

Lumen_SystemBC_Sept2025

ATTACK:enterprise:S0533 → uses → ATTACK:enterprise:T1001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6d182b64-121f-43bf-b268-fe1e5874087d

CISA MAR SLOTHFULMEDIA October 2020

ATTACK:enterprise:T1001.003 → subtechnique-of → ATTACK:enterprise:T1001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--723b4534-34cc-4b65-9547-f461cb744586

ATTACK:enterprise:S1100 → uses → ATTACK:enterprise:T1001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--784ac574-4c0d-485e-ae56-63d3b88e383f

Kaspersky ToddyCat June 2022

ATTACK:enterprise:S0682 → uses → ATTACK:enterprise:T1001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--7bade69a-16f3-4d2d-bec5-c7dc76358787

CrowdStrike StellarParticle January 2022

ATTACK:enterprise:C0014 → uses → ATTACK:enterprise:T1001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--80a8cd03-8f65-41fb-803a-64d92f9f1522

FoxIT Wocao December 2019

ATTACK:enterprise:M1031 → mitigates → ATTACK:enterprise:T1001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--82cf0b15-1cd0-4539-b3fe-63ee4d379113

ATTACK:enterprise:S1044 → uses → ATTACK:enterprise:T1001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d0ce49aa-fc45-431a-8109-90958fb15b5e

Bitdefender FunnyDream Campaign November 2020

ATTACK:enterprise:S1111 → uses → ATTACK:enterprise:T1001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d8c84ee1-db8d-4f32-addf-831310c93ab7

Ensilo Darkgate 2018

ATTACK:enterprise:S1120 → uses → ATTACK:enterprise:T1001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--db5014cf-3281-493d-8416-9385737cf12d

Mandiant Cutting Edge Part 2 January 2024

ATTACK:enterprise:S9003 → uses → ATTACK:enterprise:T1001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--dc27cb61-8dcf-4cc6-b166-b6faf6504c21

Evilginx 2 July 2018

ATTACK:enterprise:S0495 → uses → ATTACK:enterprise:T1001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--dd4423f6-b526-4856-aa00-2c4aa36617da

Unit42 RDAT July 2020

ATTACK:enterprise:S0381 → uses → ATTACK:enterprise:T1001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--efd7f218-0e23-458b-be17-afad9545fa25

Proofpoint TA505 Mar 2018

ATTACK:enterprise:S0610 → uses → ATTACK:enterprise:T1001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--f0782cdb-1b7a-4e23-acb4-dba55ad03468

Check Point APT34 April 2021

ATTACK:enterprise:T1001.002 → subtechnique-of → ATTACK:enterprise:T1001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--f2d8189b-efc4-47ff-8b63-ec58e18abc7e

Provided as is, for information only, with no warranty and no liability. Not legal or professional advice. Security and radio material is for authorized, lawful use only. Full disclaimer.

Visits are logged on our own server: IP address, browser and device details, and pages viewed. We use them to understand traffic and spot attacks, and never share or sell them.