Contagious InterviewG1052 ↗
Has encrypted C2 traffic using RC4.1
tfMITRE ATT&CK sub-technique
Symmetric Cryptography T1573.001
sub-technique of T1573 Encrypted Channel
- Tactic
- Command and Control
- Platforms
- ESXi, Linux, macOS, Network Devices, Windows
- Version
- 1.2
- Created
- 16 March 2020
- Last modified
- 12 May 2026
Adversaries may employ a known symmetric encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Symmetric encryption algorithms use the same key for plaintext encryption and ciphertext decryption. Common symmetric encryption algorithms include AES, DES, 3DES, Blowfish, and RC4.
ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact
14
Threat groupsTop 13%
Threat groups87th percentile · 87% of ATT&CK techniques have this many threat groups attributed or fewer.4
CampaignsTop 10%
Campaigns90th percentile · 90% of ATT&CK techniques have this many campaigns recorded or fewer.167
Tools & malwareTop 2%
Tools & malware98th percentile · 98% of ATT&CK techniques have this many tools implementing them or fewer.0
Detection rulesNone recorded
Detection rulesNone recorded · 33% of ATT&CK techniques have none either.Symmetric Cryptography MITRE reference T1573.001
Top 13%of all ATT&CK techniques for number of groups
14 groups have been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.
RedCurlG1039 ↗
Has used AES-128 CBC to encrypt C2 communications.1
Volt TyphoonG1017 ↗
Has used a version of the Awen web shell that employed AES encryption and decryption for C2 communications.1
Mustang PandaG0129 ↗
Has encrypted C2 communications with RC4.12 Mustang Panda has also leveraged encryption and compression algorithms to obfuscate the traffic between the system and C2 server, methods observed included RC4, AES, XOR with 0x5a, and LZO.3
ZIRCONIUMG0128 ↗
Has used AES encrypted communications in C2.1
HigaisaG0126 ↗
Used AES-128 to encrypt C2 traffic.1
All 14 groups for this technique · 6 newest in this preview
4 campaigns have been recorded using this technique. Listed newest first; dates are year-granularity and attribution is MITRE’s.
RedPenguinC0056 ↗
During RedPenguin, UNC3886 malware used the RC4 cipher to encrypt outgoing C2 messages.1
3CX Supply Chain AttackC0057 ↗
During the 3CX Supply Chain Attack, AppleJeus's VEILEDSIGNAL communication module supports three commands to conduct the following actions: send implant data, execute shellcode, and terminate itself.1
Operation Dream JobC0022 ↗
During Operation Dream Job, Lazarus Group used an AES key to communicate with their C2 server.1
FrankensteinC0001 ↗
During Frankenstein, the threat actors communicated with C2 via an encrypted RC4 byte stream and AES-CBC.1
All 4 campaigns for this technique
167 software entries are documented implementing this technique. MITRE files each as a tool or as malware; newest first, then by how many groups carry them.
TeamPCP Cloud StealerS9041 ↗
Has encrypted collected data using a hybrid AES-256 and RSA-4096 encryption prior to exfiltration over 'curl`.1234
RustyWaterS9037 ↗
Has encrypted encoded data with XOR before sending it to the C2 server.1
MuddyViperS9032 ↗
Has the ability to encrypt C2 communication using AES-CBC using the CNG API, the key 0608101047106453101617106423101013101012101083109710108585106969, and the initialization vector 0.1
HiddenFaceS9023 ↗
Can use a randomly selected symmetric encryption algorithm for C2.1
LODEINFOS9020 ↗
Can encrypt C2 communication with a hardcoded (NV4HDOeOVyL) Vigenere cipher key.1
PureCrypterS9019 ↗
Can use AES to encrypt system information sent to the C2.1
All 167 software entries for this technique · 6 newest in this preview
Offense vs defense T1573.001
Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.
Symmetric Cryptography detection strategy DET0143
MITRE names one behaviour worth catching for this technique and breaks it into 5 analytics, one per platform. Each carries the log sources it needs and the fields you tune per environment.
Detection Strategy for Encrypted Channel via Symmetric Cryptography across OS Platforms
5 platforms
AN0400 · Windows
Processes that typically do not perform cryptographic operations loading symmetric encryption libraries (e.g., bcryptprimitives.dll, aes.dll), then initiating outbound connections with high-entropy payloads. Defender correlates process creation, DLL load, and anomalous encrypted traffic patterns.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Module LoadDC0016 | WinEventLog:Sysmon | EventCode=7 |
| Network Connection CreationDC0082 | WinEventLog:Sysmon | EventCode=3, 22 |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| AllowedCryptoProcesses | Processes normally expected to use symmetric crypto (e.g., disk encryption, secure messaging). |
| EntropyThreshold | Minimum payload entropy score for flagging unusual encrypted sessions. |
| TimeWindow | Correlation window between module load and encrypted connection creation. |
AN0401 · Linux
Unexpected processes (e.g., bash, python, custom binaries) dynamically loading libcrypto or performing AES/RC4 encryption operations, then initiating outbound sessions with abnormal byte entropy or asymmetric traffic patterns.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Module LoadDC0016 | linux:osquery | Process linked with libcrypto.so making external connections |
| Process CreationDC0032 | auditd:SYSCALL | execve or socket/connect system calls from processes using crypto libraries |
| Application Log ContentDC0038 | linux:syslog | System daemons initiating encrypted sessions with unexpected destinations |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| TrustedCryptoLibs | Baseline expected crypto libraries to suppress false positives. |
| TrafficAsymmetryRatio | Ratio of sent/received bytes indicating possible hidden C2. |
AN0402 · macOS
Launchd jobs or user processes invoking symmetric crypto APIs from the Security framework and generating outbound connections carrying randomized payloads inconsistent with normal TLS patterns.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Process CreationDC0032 | macos:unifiedlog | Process using AES/RC4 routines unexpectedly |
| Network Traffic ContentDC0085 | macos:unifiedlog | Encrypted connection with anomalous payload entropy |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| DoHResolvers | Legitimate DNS-over-HTTPS endpoints to avoid FP. |
| PayloadEntropyThreshold | Define entropy level at which traffic should be flagged. |
AN0403 · ESXi
ESXi daemons (hostd, vpxa) unexpectedly using symmetric encryption routines for external connections. Defender identifies logs of service traffic with encrypted payloads inconsistent with VMware management baselines.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Application Log ContentDC0038 | esxi:vpxd | Symmetric crypto routines triggered for external session |
| Network Traffic ContentDC0085 | esxcli:network | Socket sessions with randomized payloads inconsistent with TLS |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| AllowedMgmtHosts | Baseline list of approved vCenter and update endpoints. |
AN0404 · Network Devices
Flows showing encrypted payloads with high entropy not matching TLS handshake patterns, particularly when occurring on non-standard ports. Defender observes NetFlow/IPFIX byte distribution anomalies or IDS/IPS detecting symmetric encryption patterns without associated key exchange.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Network Traffic FlowDC0078 | NSM:Flow | Flow records with entropy signatures resembling symmetric encryption |
| Network Traffic ContentDC0085 | NSM:Connections | Symmetric encryption detected without TLS handshake sequence |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| PortProfiles | Baseline expected encryption by port/protocol. |
| TrafficVolumeThreshold | Volume thresholds for distinguishing benign VPN traffic from hidden C2. |
Network intrusion detection and prevention systems that use network signatures to identify traffic for specific adversary malware can be used to mitigate activity at the network level.