MITRE ATT&CKsub-technique

T1573.002 Asymmetric Cryptography

Published 2020-03-16 Modified 2026-09-11 Official page ↗
Domain
enterprise
Tactics
Command And Control
Platforms
ESXi, Linux, macOS, Network Devices, Windows
Version
1.3
Created
2020-03-16

Description

Adversaries may employ a known asymmetric encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Asymmetric cryptography, also known as public key cryptography, uses a keypair per party: one public that can be freely distributed, and one private. Due to how the keys are generated, the sender encrypts data with the receiver’s public key and the receiver decrypts the data with their private key. This ensures that only the intended recipient can read the encrypted data. Common public key encryption algorithms include RSA and ElGamal. For efficiency, many protocols (including SSL/TLS) use symmetric cryptography once a connection is established, but use asymmetric cryptography to establish or transmit a key. As such, these protocols are classified as Asymmetric Cryptography.

Related

Subtechnique of · MITRE ATT&CK (1)

  • T1573 Encrypted Channel technique

Tactic · MITRE ATT&CK (1)

  • TA0011 Command and Control tactic

Referenced by MITRE ATT&CK · mitigates (2)

  • M1031 Network Intrusion Prevention mitigation
  • M1020 SSL/TLS Inspection mitigation

Referenced by MITRE ATT&CK · uses (99)

  • S9067 TWOSTROKE software (malware)
  • S9050 Vidar software (malware)
  • G1057 ShinyHunters group
  • S9041 TeamPCP Cloud Stealer software (malware)
  • S9035 LAMEHUG software (malware)
  • S9023 HiddenFace software (malware)
  • S9015 BRICKSTORM software (malware)
  • S9017 DCRAT software (tool)
  • S9019 PureCrypter software (malware)
  • G1051 Medusa Group group
  • S1224 CASTLETAP software (malware)
  • S1219 REPTILE software (malware)
  • S1213 Lumma Stealer software (malware)
  • S1210 Sagerunex software (malware)
  • G1047 Velvet Ant group
  • S1203 J-magic software (malware)
  • S1198 Gomir software (malware)
  • G1044 APT42 group
  • S1192 NICECURL software (malware)
  • S1184 BOLDMOVE software (malware)
  • S1172 OilBooster software (malware)
  • S1169 Mango software (malware)
  • C0043 Indian Critical Infrastructure Intrusions campaign
  • G1042 RedEcho group
  • S1163 SnappyTCP software (malware)
  • G1039 RedCurl group
  • C0040 APT41 DUST campaign
  • S1155 Covenant software (tool)
  • C0039 Versa Director Zero Day Exploitation campaign
  • S1144 FRP software (tool)
Show all 99 ›

Referenced by Compliance · mitigates (12)

  • CIS-13.8 Deploy a Network Intrusion Prevention Solution CIS Safeguard v8.1
  • NIST-AC-4 Information Flow Enforcement NIST 800-53 control
  • NIST-CA-7 Continuous Monitoring NIST 800-53 control
  • NIST-CM-2 Baseline Configuration NIST 800-53 control
  • NIST-CM-6 Configuration Settings NIST 800-53 control
  • NIST-CM-7 Least Functionality NIST 800-53 control
  • NIST-SC-12 Cryptographic Key Establishment and Management NIST 800-53 control
  • NIST-SC-16 Transmission of Security and Privacy Attributes NIST 800-53 control
  • NIST-SC-23 Session Authenticity NIST 800-53 control
  • NIST-SC-7 Boundary Protection NIST 800-53 control
  • NIST-SI-3 Malicious Code Protection NIST 800-53 control
  • NIST-SI-4 System Monitoring NIST 800-53 control

References