Techniques › T1573 › T1573.002
T1573.002 Asymmetric Cryptography
command and control — ESXi, Linux, macOS, Network Devices, Windows · attack.mitre.org · JSON
1
MITRE detection strategy
5
analytics
0
Sigma rules tagged attack.t1573.002
0
KEV CVEs mapped here
<p>Adversaries may employ a known asymmetric encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Asymmetric cryptography, also known as public key cryptography, uses a keypair per party: one public that can be freely distributed, and one private. Due to how the keys are generated, the sender encrypts data with the receiver’s public key and the receiver decrypts the data with their private key. This ensures that only the intended recipient can read the encrypted data. Common public key encryption algorithms include RSA and ElGamal.</p><p>For efficiency, many protocols (including SSL/TLS) use symmetric cryptography once a connection is established, but use asymmetric cryptography to establish or transmit a key. As such, these protocols are classified as Asymmetric Cryptography.</p>
KEV CVEs mapped to this technique · CTID Mappings Explorer
None. No KEV entry in the public mapping names this technique. Given that 74.7% of KEV has no mapping at all, this says more about the mapping than about the technique.
Detection strategy · ATT&CK Enterprise v19.2
- DET0543 Detection Strategy for Encrypted Channel via Asymmetric Cryptography across OS Platforms v1.0
AN1496 WindowsProcesses not typically associated with encryption loading asymmetric crypto libraries (e.g., rsaenh.dll, crypt32.dll) and subsequently initiating outbound TLS/SSL connections with abnormal certificate chains or handshakes. Defender correlates process creation, module load, and unusual encrypted sessions.Tunable:
AllowedCryptoProcessesCertificateAuthorityListHandshakeTimeoutAN1497 LinuxProcesses (e.g., bash, python, custom binaries) dynamically linking libcrypto/libssl for RSA key exchange, then creating external connections with abnormal certificate validation or handshake anomalies. Defender observes syscall traces and outbound asymmetric key exchanges from non-SSL-native processes.auditd:SYSCALLexecve or socket/connect system calls for processes using RSA handshake→ DC0032 Process Creationlinux:syslogNon-standard processes negotiating SSL/TLS key exchanges→ DC0038 Application Log Contentlinux:osqueryProcesses linked with libssl/libcrypto performing network activity→ DC0016 Module LoadTunable:ExpectedCryptoLibsTrafficAsymmetryRatioAN1498 macOSApplications or launchd services invoking RSA or public-key routines from the Security framework, followed by outbound SSL/TLS sessions with unrecognized certs or anomalous handshakes. Defender observes unified logs of API calls and suspicious network entropy.macos:unifiedlogProcess invoking SecKeyCreateRandomKey or asymmetric crypto APIs→ DC0032 Process Creationmacos:unifiedlogTLS connections with abnormal handshake sequence or self-signed cert→ DC0085 Network Traffic ContentTunable:TrustedDoHEndpointsPayloadEntropyThresholdAN1499 ESXiVMware services (hostd, vpxa) unexpectedly negotiating asymmetric crypto sessions to external endpoints outside vCenter or update servers. Defender sees encrypted handshakes in logs inconsistent with baseline ESXi communication patterns.esxi:vpxdESXi process initiating asymmetric handshake with external host→ DC0038 Application Log Contentesxcli:networkSocket inspection showing RSA key exchange outside baseline endpoints→ DC0085 Network Traffic ContentTunable:BaselineMgmtHostsAN1500 Network DevicesEncrypted sessions detected with asymmetric key exchange anomalies on non-standard ports or with invalid/malformed certs. Defender correlates NetFlow/IPFIX with IDS/IPS detecting RSA exchanges outside expected TLS flows.IDS:TLSInspectionMalformed certs, incomplete asymmetric handshakes, or invalid CAs→ DC0085 Network Traffic ContentTunable:PortProfilesCertValidationPolicy
Sigma rules · SigmaHQ da9bb07d64, tag attack.t1573.002
No Sigma rule carries this tag. MITRE publishes a detection strategy above, so the behaviour is specified; what is missing is public detection content.
Rules tagged at the parent level (attack.t1573) 6
These target the parent technique, not this sub-technique specifically. Listed for completeness, not counted as coverage.
Author: Austin Songer @austinsonger
· 2021-08-23 (modified 2022-10-09) · logsource: product=m365 service=threat_management · 0f2468a2-5055-4212-a368-7321198ee706
Detects when a Microsoft Cloud App Security reported when an activity occurs from a location that wasn't recently or never visited by any user in the organization.
Author: frack113
· 2022-01-23 · logsource: product=windows category=ps_script · 195626f3-5f1b-4403-93b7-e6cfd4d6a078
Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol.
Author: Austin Songer @austinsonger
· 2021-08-23 (modified 2022-10-09) · logsource: product=m365 service=threat_detection · a3501e8e-af9e-43c6-8cd6-9360bdaae498
Detects when a Microsoft Cloud App Security reported users were active from an IP address identified as risky by Microsoft Threat Intelligence.
These IP addresses are involved in malicious activities, such as Botnet C&C, and may indicate compromised account.
Author: Andreas Braathen (mnemonic.io)
· 2023-10-27 (modified 2024-01-26) · logsource: product=windows category=network_connection · cae6cee6-0244-44d2-84ed-e65f548eb7dc
Detects the execution of rundll32 that leads to an external network connection.
The malware Pikabot has been seen to use this technique to initiate C2-communication through hard-coded Windows binaries.
Author: Austin Songer @austinsonger
· 2021-08-23 (modified 2022-10-09) · logsource: product=m365 service=threat_management · d8b0a4fe-07a8-41be-bd39-b14afa025d95
Detects when a Microsoft Cloud App Security reported when users were active from an IP address that has been identified as an anonymous proxy IP address.
Author: Arda Buyukkaya (EclecticIQ)
· 2025-02-11 · logsource: product=windows category=process_creation · e99375eb-3ee0-407a-9f90-79569cc6a01c
Detects the execution of the "curl.exe" command, referencing "SOCKS" and ".onion" domains, which could be indicative of Kalambur backdoor activity.