Techniques › T1600 › T1600.001
T1600.001 Reduce Key Space
defense impairment — Network Devices · attack.mitre.org · JSON
1
MITRE detection strategy
1
analytics
0
Sigma rules tagged attack.t1600.001
0
KEV CVEs mapped here
<p>Adversaries may reduce the level of effort required to decrypt data transmitted over the network by reducing the cipher strength of encrypted communications.</p><p>Adversaries can weaken the encryption software on a compromised network device by reducing the key size used by the software to convert plaintext to ciphertext (e.g., from hundreds or thousands of bytes to just a couple of bytes). As a result, adversaries dramatically reduce the amount of effort needed to decrypt the protected information without the key.</p><p>Adversaries may modify the key size used and other encryption parameters using specialized commands in a Network Device CLI introduced to the system through Modify System Image to change the configuration of the device.</p>
KEV CVEs mapped to this technique · CTID Mappings Explorer
None. No KEV entry in the public mapping names this technique. Given that 74.7% of KEV has no mapping at all, this says more about the mapping than about the technique.
Detection strategy · ATT&CK Enterprise v19.2
- DET0243 Detection Strategy for Weaken Encryption: Reduce Key Space on Network Devices v1.0
AN0681 Network DevicesDefenders may observe attempts to alter cryptographic settings on network devices that reduce key strength or allowable cipher suites. Suspicious indicators include configuration changes that downgrade encryption algorithms, key length parameters, or the disabling of strong encryption in favor of legacy ciphers. These activities often appear as CLI commands modifying crypto policies, firmware changes affecting crypto libraries, or unexpected updates to key management files. Correlation across device config logs and traffic analysis showing weaker ciphers provides higher confidence of malicious key space reduction.networkdevice:config
Configuration changes referencing 'crypto', 'key length', 'cipher', or downgrade of encryption settings→ DC0061 File Modificationnetworkdevice:cliExecution of CLI commands altering crypto parameters (e.g., 'crypto key generate rsa modulus 512')→ DC0064 Command ExecutionNSM:FlowObserved downgrade in negotiated cipher suites or TLS/SSH versions across sessions→ DC0085 Network Traffic ContentTunable:AllowedKeyLengthsCipherSuiteBaselineAuthorizedAdminAccountsTimeWindow
Sigma rules · SigmaHQ da9bb07d64, tag attack.t1600.001
No Sigma rule carries this tag. MITRE publishes a detection strategy above, so the behaviour is specified; what is missing is public detection content.