Sigma Watch is free and independent. If it saves you time, keep it running. ☕ Buy me a coffee
SigmaWatch
ATT&CK technique

T1001

Data Obfuscation

Command and Control 28 detections found
View on MITRE ATT&CK →

Detection rules

Source Rule Status Updated
splunk Windows PowGoop Beacon Decoding production 2026-05-13
splunk Windows Suspicious QEMU Execution production 2026-05-13
snort ET TROJAN MonsterV2 Stealer CnC Checkin rev 1 2025-03-31
suricata ET MALWARE MonsterV2 Stealer CnC Checkin rev 1 2025-03-31
suricata ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile M2 rev 6 2024-05-04
suricata ET MALWARE NOBELIUM - Cobalt Strike Malleable Profile M1 rev 4 2024-04-30
suricata ET MALWARE Cobalt Strike Malleable C2 Amazon Profile rev 6 2024-04-28
suricata ET MALWARE Cobalt Strike Malleable C2 Webbug Profile rev 7 2024-04-28
suricata ET MALWARE Cobalt Strike Malleable C2 OCSP Profile rev 7 2024-04-14
suricata ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile M5 rev 3 2024-04-04
suricata ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile M3 rev 4 2024-04-04
suricata ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile M6 rev 3 2024-04-03
suricata ET INFO Adilbo HTML Encoder Observed rev 6 2024-03-14
suricata ET MALWARE PLATINUM Steganographic HTTP Response Page Inbound rev 4 2024-03-07
snort ET INFO Adilbo HTML Encoder Observed rev 4 2023-05-02
snort ET TROJAN Cobalt Strike Malleable C2 JQuery Custom Profile M6 rev 1 2022-06-29
snort ET TROJAN NOBELIUM - Cobalt Strike Malleable Profile M1 rev 2 2021-12-07
snort ET TROJAN Cobalt Strike Malleable C2 JQuery Custom Profile M5 rev 2 2021-11-15
snort ET TROJAN Cobalt Strike Malleable C2 JQuery Custom Profile M2 rev 3 2021-08-05
suricata ET JA3 Hash - Possible Cobalt Strike Server rev 1 2021-07-23
suricata ET JA3 Hash - Possible Cobalt Strike Server rev 1 2021-07-23
suricata ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile Response rev 1 2021-05-21
snort ET TROJAN Cobalt Strike Malleable C2 JQuery Custom Profile Response rev 1 2021-05-21
snort ET TROJAN Cobalt Strike Malleable C2 JQuery Custom Profile M3 rev 2 2021-05-21
snort ET TROJAN PLATINUM Steganographic HTTP Response Page Inbound rev 2 2019-06-05
snort ET TROJAN Cobalt Strike Malleable C2 Webbug Profile rev 3 2018-06-14
snort ET TROJAN Cobalt Strike Malleable C2 OCSP Profile rev 1 2017-05-15
snort ET TROJAN Cobalt Strike Malleable C2 Amazon Profile rev 1 2017-04-28