Techniques › T1573 › T1573.001
T1573.001 Symmetric Cryptography
command and control — ESXi, Linux, macOS, Network Devices, Windows · attack.mitre.org · JSON
1
MITRE detection strategy
5
analytics
0
Sigma rules tagged attack.t1573.001
3
KEV CVEs mapped here
<p>Adversaries may employ a known symmetric encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Symmetric encryption algorithms use the same key for plaintext encryption and ciphertext decryption. Common symmetric encryption algorithms include AES, DES, 3DES, Blowfish, and RC4.</p>
KEV CVEs mapped to this technique · CTID Mappings Explorer
| CVE | Vendor / product | Mapping type | State | Added |
|---|---|---|---|---|
| CVE-2021-44077 | Zoho ManageEngine ServiceDesk Plus (SDP) / SupportCenter Plus | secondary impact | Mapped | 2021-12-01 |
| CVE-2021-40449 | Microsoft Windows | secondary impact | Mapped | 2021-11-17 |
| CVE-2021-40539 | Zoho ManageEngine | secondary impact | Mapped | 2021-11-03 |
Detection strategy · ATT&CK Enterprise v19.2
- DET0143 Detection Strategy for Encrypted Channel via Symmetric Cryptography across OS Platforms v1.0
AN0400 WindowsProcesses that typically do not perform cryptographic operations loading symmetric encryption libraries (e.g., bcryptprimitives.dll, aes.dll), then initiating outbound connections with high-entropy payloads. Defender correlates process creation, DLL load, and anomalous encrypted traffic patterns.Tunable:
AllowedCryptoProcessesEntropyThresholdTimeWindowAN0401 LinuxUnexpected processes (e.g., bash, python, custom binaries) dynamically loading libcrypto or performing AES/RC4 encryption operations, then initiating outbound sessions with abnormal byte entropy or asymmetric traffic patterns.auditd:SYSCALLexecve or socket/connect system calls from processes using crypto libraries→ DC0032 Process Creationlinux:syslogSystem daemons initiating encrypted sessions with unexpected destinations→ DC0038 Application Log ContentTunable:TrustedCryptoLibsTrafficAsymmetryRatioAN0402 macOSLaunchd jobs or user processes invoking symmetric crypto APIs from the Security framework and generating outbound connections carrying randomized payloads inconsistent with normal TLS patterns.macos:unifiedlogEncrypted connection with anomalous payload entropy→ DC0085 Network Traffic ContentTunable:DoHResolversPayloadEntropyThresholdAN0403 ESXiESXi daemons (hostd, vpxa) unexpectedly using symmetric encryption routines for external connections. Defender identifies logs of service traffic with encrypted payloads inconsistent with VMware management baselines.esxcli:networkSocket sessions with randomized payloads inconsistent with TLS→ DC0085 Network Traffic ContentTunable:AllowedMgmtHostsAN0404 Network DevicesFlows showing encrypted payloads with high entropy not matching TLS handshake patterns, particularly when occurring on non-standard ports. Defender observes NetFlow/IPFIX byte distribution anomalies or IDS/IPS detecting symmetric encryption patterns without associated key exchange.NSM:FlowFlow records with entropy signatures resembling symmetric encryption→ DC0078 Network Traffic FlowNSM:ConnectionsSymmetric encryption detected without TLS handshake sequence→ DC0085 Network Traffic ContentTunable:PortProfilesTrafficVolumeThreshold
Sigma rules · SigmaHQ da9bb07d64, tag attack.t1573.001
No Sigma rule carries this tag. MITRE publishes a detection strategy above, so the behaviour is specified; what is missing is public detection content. 3 actively exploited CVEs map here.
Rules tagged at the parent level (attack.t1573) 6
These target the parent technique, not this sub-technique specifically. Listed for completeness, not counted as coverage.
Author: Austin Songer @austinsonger
· 2021-08-23 (modified 2022-10-09) · logsource: product=m365 service=threat_management · 0f2468a2-5055-4212-a368-7321198ee706
Detects when a Microsoft Cloud App Security reported when an activity occurs from a location that wasn't recently or never visited by any user in the organization.
Author: frack113
· 2022-01-23 · logsource: product=windows category=ps_script · 195626f3-5f1b-4403-93b7-e6cfd4d6a078
Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol.
Author: Austin Songer @austinsonger
· 2021-08-23 (modified 2022-10-09) · logsource: product=m365 service=threat_detection · a3501e8e-af9e-43c6-8cd6-9360bdaae498
Detects when a Microsoft Cloud App Security reported users were active from an IP address identified as risky by Microsoft Threat Intelligence.
These IP addresses are involved in malicious activities, such as Botnet C&C, and may indicate compromised account.
Author: Andreas Braathen (mnemonic.io)
· 2023-10-27 (modified 2024-01-26) · logsource: product=windows category=network_connection · cae6cee6-0244-44d2-84ed-e65f548eb7dc
Detects the execution of rundll32 that leads to an external network connection.
The malware Pikabot has been seen to use this technique to initiate C2-communication through hard-coded Windows binaries.
Author: Austin Songer @austinsonger
· 2021-08-23 (modified 2022-10-09) · logsource: product=m365 service=threat_management · d8b0a4fe-07a8-41be-bd39-b14afa025d95
Detects when a Microsoft Cloud App Security reported when users were active from an IP address that has been identified as an anonymous proxy IP address.
Author: Arda Buyukkaya (EclecticIQ)
· 2025-02-11 · logsource: product=windows category=process_creation · e99375eb-3ee0-407a-9f90-79569cc6a01c
Detects the execution of the "curl.exe" command, referencing "SOCKS" and ".onion" domains, which could be indicative of Kalambur backdoor activity.