tfMITRE ATT&CK technique

Encrypted Channel T1573

Tactic: Command and Control
Platforms: ESXi, Linux, macOS, Network Devices, Windows
Version: 1.2
Created: 16 March 2020
Last modified: 24 October 2025

Sub-techniques 213 rules across the family · 8 mapped directly to T1573 · 1 of 2 carry rules

.001Symmetric Cryptography0 .002Asymmetric Cryptography5

Adversaries may employ an encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.

ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact

Threat groups70th pct

Threat groups70th percentile · 64% of ATT&CK techniques have fewer threat groups attributed.

CampaignsTop 17%

Campaigns83rd percentile · 73% of ATT&CK techniques have fewer campaigns recorded.

Tools & malwareTop 24%

Tools & malware76th percentile · 74% of ATT&CK techniques have fewer tools implementing them.

Detection rules72nd pct

Detection rules72nd percentile · 69% of ATT&CK techniques have fewer detection rules written.

Offense vs defense T1573

Compare defenses against adversary use. Eight counts, ranking this technique against the entire ATT&CK Enterprise matrix. Attack sits left, defense right.

Range

Technique Campaign use over its cumulative rule count.

Campaigns · 1Sigma rules (cumulative) · 6Splunk ESCU (cumulative) · 2

Data component	Name	Channel
Module LoadDC0016	WinEventLog:Sysmon	EventCode=7
Network Connection CreationDC0082	WinEventLog:Sysmon	EventCode=3, 22

Data component

Name

Channel

Module LoadDC0016

WinEventLog:Sysmon

EventCode=7

Network Connection CreationDC0082

WinEventLog:Sysmon

EventCode=3, 22

Field	What you tune
AllowedEncryptedProcesses	Whitelist processes expected to use TLS (e.g., browsers, mail clients).
EntropyThreshold	Payload randomness threshold to distinguish C2 encryption from legitimate traffic.
TimeWindow	Correlation window between process creation, module load, and encrypted connection.

Field

What you tune

AllowedEncryptedProcesses

Whitelist processes expected to use TLS (e.g., browsers, mail clients).

EntropyThreshold

Payload randomness threshold to distinguish C2 encryption from legitimate traffic.

TimeWindow

Correlation window between process creation, module load, and encrypted connection.

Data component	Name	Channel
Process CreationDC0032	linux:osquery	Processes linked with libssl or crypto libraries making outbound connections
Application Log ContentDC0038	linux:syslog	system daemons initiating TLS sessions outside expected services
Network Connection CreationDC0082	auditd:SYSCALL	socket/connect with TLS context by unexpected process

Field	What you tune
WhitelistedDaemons	Legitimate system services expected to use TLS (e.g., package updates).
CertificateAuthorities	Trusted CAs; flag self-signed or unrecognized certs.

Data component	Name	Channel
Process CreationDC0032	macos:unifiedlog	Process invoking SSL routines from Security framework
Network Traffic ContentDC0085	macos:unifiedlog	Encrypted session initiation by unexpected binary

Field	What you tune
DoHResolvers	Known legitimate DoH endpoints to reduce false positives.
PayloadEntropyThreshold	High-entropy traffic deviations used to detect concealed channels.

Data component	Name	Channel
Network Traffic FlowDC0078	esxi:vpxd	TLS session established by ESXi service to unapproved endpoint
Network Traffic ContentDC0085	esxi:vmkernel	Inspection of sockets showing encrypted sessions from non-baseline processes

Field	What you tune
AllowedMgmtHosts	Baseline approved endpoints for vCenter or update services.

Data component	Name	Channel
Network Traffic FlowDC0078	NSM:Flow	Session records with TLS-like byte patterns
Network Traffic ContentDC0085	NSM:Connections	Abnormal certificate chains or non-standard ports carrying TLS

Field	What you tune
PortProfiles	Define expected TLS port usage to flag anomalies.
TrafficAsymmetryRatio	Sent/received byte thresholds to catch hidden C2.

Offense vs defense T1573

Compare defenses against adversary use. Eight counts, ranking this technique against the entire ATT&CK Enterprise matrix. Attack sits left, defense right.

Range

Technique Campaign use over its cumulative rule count.

Campaigns · 1Sigma rules (cumulative) · 6Splunk ESCU (cumulative) · 2

Data component	Name	Channel
Module LoadDC0016	WinEventLog:Sysmon	EventCode=7
Network Connection CreationDC0082	WinEventLog:Sysmon	EventCode=3, 22

Data component

Name

Channel

Module LoadDC0016

WinEventLog:Sysmon

EventCode=7

Network Connection CreationDC0082

WinEventLog:Sysmon

EventCode=3, 22

Field	What you tune
AllowedEncryptedProcesses	Whitelist processes expected to use TLS (e.g., browsers, mail clients).
EntropyThreshold	Payload randomness threshold to distinguish C2 encryption from legitimate traffic.
TimeWindow	Correlation window between process creation, module load, and encrypted connection.

Field

What you tune

AllowedEncryptedProcesses

Whitelist processes expected to use TLS (e.g., browsers, mail clients).

EntropyThreshold

Payload randomness threshold to distinguish C2 encryption from legitimate traffic.

TimeWindow

Correlation window between process creation, module load, and encrypted connection.

Data component	Name	Channel
Process CreationDC0032	linux:osquery	Processes linked with libssl or crypto libraries making outbound connections
Application Log ContentDC0038	linux:syslog	system daemons initiating TLS sessions outside expected services
Network Connection CreationDC0082	auditd:SYSCALL	socket/connect with TLS context by unexpected process

Field	What you tune
WhitelistedDaemons	Legitimate system services expected to use TLS (e.g., package updates).
CertificateAuthorities	Trusted CAs; flag self-signed or unrecognized certs.

Data component	Name	Channel
Process CreationDC0032	macos:unifiedlog	Process invoking SSL routines from Security framework
Network Traffic ContentDC0085	macos:unifiedlog	Encrypted session initiation by unexpected binary

Field	What you tune
DoHResolvers	Known legitimate DoH endpoints to reduce false positives.
PayloadEntropyThreshold	High-entropy traffic deviations used to detect concealed channels.

Data component	Name	Channel
Network Traffic FlowDC0078	esxi:vpxd	TLS session established by ESXi service to unapproved endpoint
Network Traffic ContentDC0085	esxi:vmkernel	Inspection of sockets showing encrypted sessions from non-baseline processes

Field	What you tune
AllowedMgmtHosts	Baseline approved endpoints for vCenter or update services.

Data component	Name	Channel
Network Traffic FlowDC0078	NSM:Flow	Session records with TLS-like byte patterns
Network Traffic ContentDC0085	NSM:Connections	Abnormal certificate chains or non-standard ports carrying TLS

Field	What you tune
PortProfiles	Define expected TLS port usage to flag anomalies.
TrafficAsymmetryRatio	Sent/received byte thresholds to catch hidden C2.

Select	Description	Category	Status	Event	OS	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID
	Detects when a Microsoft Cloud App Security reported when users were active from an IP address that has been identified as an anonymous proxy IP address.	Generic	test	-	-	Azure Threat Management · Microsoft 365	Command and Control Encrypted Channel	-	medium	Austin Songer @austinsonger	2021-08-23	2022-10-09	d8b0a4fe-07a8-41be-bd39-b14afa025d95
	Detects when a Microsoft Cloud App Security reported when an activity occurs from a location that wasn't recently or never visited by any user in the organization.	Generic	test	-	-	Azure Threat Management · Microsoft 365	Command and Control Encrypted Channel	-	medium	Austin Songer @austinsonger	2021-08-23	2022-10-09	0f2468a2-5055-4212-a368-7321198ee706
	Detects when a Microsoft Cloud App Security reported users were active from an IP address identified as risky by Microsoft Threat Intelligence. (...)	Generic	test	-	-	Azure Threat Detection · Microsoft 365	Command and Control Encrypted Channel	-	medium	Austin Songer @austinsonger	2021-08-23	2022-10-09	a3501e8e-af9e-43c6-8cd6-9360bdaae498
	Detects the execution of the "curl.exe" command, referencing "SOCKS" and ".onion" domains, which could be indicative of Kalambur backdoor activity.	Emerging	experimental	process_creation	windows	Sysmon · WinEventLog Security	Command and Control Application Layer Protocol Web Protocols Execution Command and Scripting Interpreter PowerShell Command and Control Encrypted Channel Command and Control Proxy	-	high	Arda Buyukkaya (EclecticIQ)	2025-02-11	—	e99375eb-3ee0-407a-9f90-79569cc6a01c
	Detects the execution of rundll32 that leads to an external network connection. (...)	Emerging	test	network_connection	windows	Sysmon	Command and Control Encrypted Channel	-	high	Andreas Braathen (mnemonic.io)	2023-10-27	2024-01-26	cae6cee6-0244-44d2-84ed-e65f548eb7dc
Splunk	The following analytic detects SSL certificates with Punycode domains in the SSL issuer email domain, identified by the prefix "xn--". (...)	Hunting	experimental	certificate	-	-	Command and Control Encrypted Channel	CVE-2022-3602	medium	Michael Haag, Splunk	2022-12-19	2026-05-13	696694df-5706-495a-81f2-79501fa11b90
	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol.	Generic	test	ps_script	windows	PowerShell	Command and Control Encrypted Channel	-	low	frack113	2022-01-23	—	195626f3-5f1b-4403-93b7-e6cfd4d6a078
Splunk	The following analytic detects the presence of punycode within x509 certificates using Zeek x509 logs. (...)	Hunting	experimental	network_connection	-	Zeek	Command and Control Encrypted Channel	CVE-2022-3602	medium	Michael Haag, Splunk	2022-12-19	2026-05-13	029d6fe4-a5fe-43af-827e-c78c50e81d81

Title

Description

Encrypted Channel T1573

Encrypted Channel T1573

Encrypted Channel MITRE reference T1573

Offense vs defense T1573

Encrypted Channel detection strategy DET0273

Detection Strategy for Encrypted Channel across OS Platforms

Log sources

Tunable fields

Log sources

Tunable fields

Log sources

Tunable fields

Log sources

Tunable fields

Log sources

Tunable fields

Encrypted Channel MITRE reference T1573

Offense vs defense T1573

Encrypted Channel detection strategy DET0273

Detection Strategy for Encrypted Channel across OS Platforms

Log sources

Tunable fields

Log sources

Tunable fields

Log sources

Tunable fields

Log sources

Tunable fields

Log sources

Tunable fields

Encrypted Channel detections T1573

Encrypted Channel detections T1573