Techniques › T1573
T1573 Encrypted Channel
command and control — ESXi, Linux, macOS, Network Devices, Windows · attack.mitre.org · JSON
1
MITRE detection strategy
5
analytics
6
Sigma rules tagged attack.t1573
0
KEV CVEs mapped here
<p>Adversaries may employ an encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.</p>
KEV CVEs mapped to this technique · CTID Mappings Explorer
None. No KEV entry in the public mapping names this technique. Given that 74.7% of KEV has no mapping at all, this says more about the mapping than about the technique.
Detection strategy · ATT&CK Enterprise v19.2
- DET0273 Detection Strategy for Encrypted Channel across OS Platforms v1.0
AN0759 WindowsProcesses that normally do not initiate network connections establishing outbound encrypted TLS/SSL sessions, especially with asymmetric traffic volumes (client sending more than receiving) or non-standard certificate chains. Defender observations correlate process creation with unexpected network encryption libraries being loaded.Tunable:
AllowedEncryptedProcessesEntropyThresholdTimeWindowAN0760 LinuxProcesses like curl, wget, python, socat, or custom binaries initiating TLS/SSL sessions to non-standard destinations. Defender sees abnormal syscalls for connect(), loading of libssl libraries, and persistent outbound encrypted traffic from daemons not normally communicating externally.auditd:SYSCALLsocket/connect with TLS context by unexpected process→ DC0082 Network Connection Creationlinux:syslogsystem daemons initiating TLS sessions outside expected services→ DC0038 Application Log Contentlinux:osqueryProcesses linked with libssl or crypto libraries making outbound connections→ DC0032 Process CreationTunable:WhitelistedDaemonsCertificateAuthoritiesAN0761 macOSApplications or launchd jobs initiating encrypted TLS traffic to rare external hosts. Defender observes unified logs showing ssl/TLS API calls by processes not baseline-approved, and payload entropy suggesting encrypted C2 sessions.Tunable:DoHResolversPayloadEntropyThresholdAN0762 ESXiVMware management daemons or guest processes initiating encrypted connections outside expected vCenter, update servers, or internal comms. Defender identifies hostd or vpxa initiating outbound TLS flows with uncommon destinations.esxi:vpxdTLS session established by ESXi service to unapproved endpoint→ DC0078 Network Traffic Flowesxi:vmkernelInspection of sockets showing encrypted sessions from non-baseline processes→ DC0085 Network Traffic ContentTunable:AllowedMgmtHostsAN0763 Network DevicesUnusual TLS tunnels through ports not normally encrypted (e.g., TLS on port 8080, 53). Defender sees NetFlow/IPFIX or packet inspection indicating high-entropy traffic volumes and asymmetric client/server exchange ratios.NSM:ConnectionsAbnormal certificate chains or non-standard ports carrying TLS→ DC0085 Network Traffic ContentTunable:PortProfilesTrafficAsymmetryRatio
Sigma rules · SigmaHQ da9bb07d64, tag attack.t1573
Author: Austin Songer @austinsonger
· 2021-08-23 (modified 2022-10-09) · logsource: product=m365 service=threat_management · 0f2468a2-5055-4212-a368-7321198ee706
Detects when a Microsoft Cloud App Security reported when an activity occurs from a location that wasn't recently or never visited by any user in the organization.
Author: frack113
· 2022-01-23 · logsource: product=windows category=ps_script · 195626f3-5f1b-4403-93b7-e6cfd4d6a078
Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol.
Author: Austin Songer @austinsonger
· 2021-08-23 (modified 2022-10-09) · logsource: product=m365 service=threat_detection · a3501e8e-af9e-43c6-8cd6-9360bdaae498
Detects when a Microsoft Cloud App Security reported users were active from an IP address identified as risky by Microsoft Threat Intelligence.
These IP addresses are involved in malicious activities, such as Botnet C&C, and may indicate compromised account.
Author: Andreas Braathen (mnemonic.io)
· 2023-10-27 (modified 2024-01-26) · logsource: product=windows category=network_connection · cae6cee6-0244-44d2-84ed-e65f548eb7dc
Detects the execution of rundll32 that leads to an external network connection.
The malware Pikabot has been seen to use this technique to initiate C2-communication through hard-coded Windows binaries.
Author: Austin Songer @austinsonger
· 2021-08-23 (modified 2022-10-09) · logsource: product=m365 service=threat_management · d8b0a4fe-07a8-41be-bd39-b14afa025d95
Detects when a Microsoft Cloud App Security reported when users were active from an IP address that has been identified as an anonymous proxy IP address.
Author: Arda Buyukkaya (EclecticIQ)
· 2025-02-11 · logsource: product=windows category=process_creation · e99375eb-3ee0-407a-9f90-79569cc6a01c
Detects the execution of the "curl.exe" command, referencing "SOCKS" and ".onion" domains, which could be indicative of Kalambur backdoor activity.