MITRE ATT&CKsub-technique

T1573.001 Symmetric Cryptography

Published 2020-03-16 Modified 2026-09-02 Official page ↗
Domain
enterprise
Tactics
Command And Control
Platforms
ESXi, Linux, macOS, Network Devices, Windows
Version
1.3
Created
2020-03-16

Description

Adversaries may employ a known symmetric encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Symmetric encryption algorithms use the same key for plaintext encryption and ciphertext decryption. Common symmetric encryption algorithms include AES, DES, 3DES, Blowfish, and RC4.

Related

Subtechnique of · MITRE ATT&CK (1)

  • T1573 Encrypted Channel technique

Tactic · MITRE ATT&CK (1)

  • TA0011 Command and Control tactic

Referenced by MITRE ATT&CK · mitigates (1)

  • M1031 Network Intrusion Prevention mitigation

Referenced by MITRE ATT&CK · uses (185)

  • S9041 TeamPCP Cloud Stealer software (malware)
  • S9037 RustyWater software (malware)
  • S9032 MuddyViper software (malware)
  • S9020 LODEINFO software (malware)
  • S9023 HiddenFace software (malware)
  • S9019 PureCrypter software (malware)
  • S9007 HTTPTroy software (malware)
  • S9001 SystemBC software (malware)
  • G1052 Contagious Interview group
  • S1239 TONESHELL software (malware)
  • C0057 3CX Supply Chain Attack campaign
  • S1229 Havoc software (malware)
  • S1228 PUBLOAD software (malware)
  • S1226 BOOKWORM software (malware)
  • S1227 StarProxy software (malware)
  • C0056 RedPenguin campaign
  • S1223 THINCRUST software (malware)
  • S1224 CASTLETAP software (malware)
  • S1222 RIFLESPINE software (malware)
  • S1218 VIRTUALPIE software (malware)
  • S1202 LockBit 3.0 software (malware)
  • S1196 Troll Stealer software (malware)
  • S1193 TAMECAT software (malware)
  • S1169 Mango software (malware)
  • S1166 Solar software (malware)
  • G1039 RedCurl group
  • S1160 Latrodectus software (malware)
  • S1145 Pikabot software (malware)
  • S1144 FRP software (tool)
  • S1141 LunarWeb software (malware)
Show all 185 ›

Referenced by Compliance · mitigates (12)

  • CIS-13.8 Deploy a Network Intrusion Prevention Solution CIS Safeguard v8.1
  • NIST-AC-4 Information Flow Enforcement NIST 800-53 control
  • NIST-CA-7 Continuous Monitoring NIST 800-53 control
  • NIST-CM-2 Baseline Configuration NIST 800-53 control
  • NIST-CM-6 Configuration Settings NIST 800-53 control
  • NIST-CM-7 Least Functionality NIST 800-53 control
  • NIST-SC-12 Cryptographic Key Establishment and Management NIST 800-53 control
  • NIST-SC-16 Transmission of Security and Privacy Attributes NIST 800-53 control
  • NIST-SC-23 Session Authenticity NIST 800-53 control
  • NIST-SC-7 Boundary Protection NIST 800-53 control
  • NIST-SI-3 Malicious Code Protection NIST 800-53 control
  • NIST-SI-4 System Monitoring NIST 800-53 control

References