Techniques › T1573.002 › AN1497
AN1497 Analytic 1497
Linux · attack.mitre.org · ATT&CK Enterprise v19.2
<p>Processes (e.g., bash, python, custom binaries) dynamically linking libcrypto/libssl for RSA key exchange, then creating external connections with abnormal certificate validation or handshake anomalies. Defender observes syscall traces and outbound asymmetric key exchanges from non-SSL-native processes.</p>
- Detects
- T1573.002 Asymmetric Cryptography
- Part of
- DET0543 Detection Strategy for Encrypted Channel via Asymmetric Cryptography across OS Platforms
Log sources and channels
Exactly as MITRE states them in x_mitre_log_source_references. Where a channel is vague, it is vague in the source; kevmap does not tidy it.
| Log source | Channel | Data component |
|---|---|---|
| auditd:SYSCALL | execve or socket/connect system calls for processes using RSA handshake | DC0032 Process Creation |
| linux:syslog | Non-standard processes negotiating SSL/TLS key exchanges | DC0038 Application Log Content |
| linux:osquery | Processes linked with libssl/libcrypto performing network activity | DC0016 Module Load |
Mutable elements
Parameters MITRE marks as environment-specific. These are the knobs you are expected to tune; they are why an analytic is not a rule.
| Field | Description |
|---|---|
ExpectedCryptoLibs | Baseline libraries that normally handle asymmetric crypto. |
TrafficAsymmetryRatio | Threshold for client-heavy data sending vs server. |