MITRE ATT&CKtechnique

T1521 Encrypted Channel

Published 2019-10-01 Modified 2025-10-24 Official page ↗

Domain: mobile
Tactics: Command And Control
Platforms: Android, iOS
Version: 2.0
Created: 2019-10-01

Description

Adversaries may explicitly employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if necessary secret keys are encoded and/or generated within malware samples/configuration files.

Tactic · MITRE ATT&CK (1)

TA0037 Command and Control tactic

Referenced by MITRE ATT&CK · subtechnique of (3)

T1521.003 SSL Pinning sub-technique
T1521.001 Symmetric Cryptography sub-technique
T1521.002 Asymmetric Cryptography sub-technique

Referenced by MITRE ATT&CK · uses (2)

S1095 AhRat software (malware)
S0302 Twitoor software (malware)

T1521 Encrypted Channel

Description

Related

Tactic · MITRE ATT&CK (1)

Referenced by MITRE ATT&CK · subtechnique of (3)

Referenced by MITRE ATT&CK · uses (2)