MITRE ATT&CKtechnique

T1573 Encrypted Channel

Published 2020-03-16 Modified 2026-09-03 Official page ↗
Domain
enterprise
Tactics
Command And Control
Platforms
ESXi, Linux, macOS, Network Devices, Windows
Version
1.2
Created
2020-03-16

Description

Adversaries may employ an encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.

Related

Tactic · MITRE ATT&CK (1)

  • TA0011 Command and Control tactic

Referenced by MITRE ATT&CK · mitigates (2)

  • M1031 Network Intrusion Prevention mitigation
  • M1020 SSL/TLS Inspection mitigation

Referenced by MITRE ATT&CK · subtechnique of (2)

  • T1573.001 Symmetric Cryptography sub-technique
  • T1573.002 Asymmetric Cryptography sub-technique

Referenced by MITRE ATT&CK · uses (17)

  • S1198 Gomir software (malware)
  • C0035 KV Botnet Activity campaign
  • C0030 Triton Safety Instrumented System Attack campaign
  • S1046 PowGoop software (malware)
  • G1002 BITTER group
  • S1012 PowerLess software (malware)
  • S1016 MacMa software (malware)
  • S0681 Lizar software (malware)
  • S0662 RCSession software (malware)
  • S0631 Chaes software (malware)
  • S0498 Cryptoistic software (malware)
  • S0367 Emotet software (malware)
  • G0081 Tropic Trooper group
  • S0198 NETWIRE software (malware)
  • G0059 Magic Hound group
  • G0016 APT29 group
  • S0032 gh0st RAT software (malware)

Referenced by Compliance · mitigates (12)

  • CIS-13.8 Deploy a Network Intrusion Prevention Solution CIS Safeguard v8.1
  • NIST-AC-4 Information Flow Enforcement NIST 800-53 control
  • NIST-CA-7 Continuous Monitoring NIST 800-53 control
  • NIST-CM-2 Baseline Configuration NIST 800-53 control
  • NIST-CM-6 Configuration Settings NIST 800-53 control
  • NIST-CM-7 Least Functionality NIST 800-53 control
  • NIST-SC-12 Cryptographic Key Establishment and Management NIST 800-53 control
  • NIST-SC-16 Transmission of Security and Privacy Attributes NIST 800-53 control
  • NIST-SC-23 Session Authenticity NIST 800-53 control
  • NIST-SC-7 Boundary Protection NIST 800-53 control
  • NIST-SI-3 Malicious Code Protection NIST 800-53 control
  • NIST-SI-4 System Monitoring NIST 800-53 control

References