tfMITRE ATT&CK sub-technique

Asymmetric Cryptography T1573.002

sub-technique of T1573 Encrypted Channel

Tactic: Command and Control
Platforms: ESXi, Linux, macOS, Network Devices, Windows
Version: 1.2
Created: 16 March 2020
Last modified: 12 May 2026

Adversaries may employ a known asymmetric encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Asymmetric cryptography, also known as public key cryptography, uses a keypair per party: one public that can be freely distributed, and one private. Due to how the keys are generated, the sender encrypts data with the receiver’s public key and the receiver decrypts the data with their private key. This ensures that only the intended recipient can read the encrypted data. Common public key encryption algorithms include RSA and ElGamal.

ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact

Threat groupsTop 15%

Threat groups85th percentile · 85% of ATT&CK techniques have this many threat groups attributed or fewer.

CampaignsTop 9%

Campaigns91st percentile · 91% of ATT&CK techniques have this many campaigns recorded or fewer.

Tools & malwareTop 5%

Tools & malware95th percentile · 95% of ATT&CK techniques have this many tools implementing them or fewer.

Detection rules64th pct

Detection rules64th percentile · 64% of ATT&CK techniques have this many detection rules written or fewer.

Asymmetric Cryptography MITRE reference T1573.002

Top 15%of all ATT&CK techniques for number of groups

12 groups have been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.

ShinyHuntersG1057 ↗

Has established a connection between the staging host and the C2 using SSH.1

created 2026-07-291 referenceaka UNC6240

Medusa GroupG1051 ↗

Has used HTTPS for command and control.1

created 2025-10-151 reference

Velvet AntG1047 ↗

Has used a reverse SSH shell to securely communicate with victim devices.1

created 2025-03-141 reference

APT42G1044 ↗

Has used tools such as NICECURL with command and control communication taking place over HTTPS.1

created 2025-01-081 reference

RedEchoG1042 ↗

Uses SSL for network communication.1

created 2024-11-211 reference

RedCurlG1039 ↗

Has used HTTPS for C2 communication.1 2

created 2024-09-232 references

All 12 groups for this technique · 6 newest in this preview

Offense vs defense T1573.002

Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.

How it got here

Range

Adversary activity (campaign spans) over cumulative rule output. Each source is plotted independently from zero, so neither line includes the other. Campaign dates are year-granularity.

Campaigns · 3Sigma rules (cumulative) · 0Splunk ESCU (cumulative) · 5

first rule: 2025 Q2 · 3 of 5 campaigns plotted (C0021 (dated 2018), Operation Wocao (dated 2017) fall before the 2022 window)

Asymmetric Cryptography detection strategy DET0543

MITRE names one behaviour worth catching for this technique and breaks it into 5 analytics, one per platform. Each carries the log sources it needs and the fields you tune per environment.

Detection Strategy for Encrypted Channel via Asymmetric Cryptography across OS Platforms

Enterprise

5 platforms

AN1496 · Windows

Processes not typically associated with encryption loading asymmetric crypto libraries (e.g., rsaenh.dll, crypt32.dll) and subsequently initiating outbound TLS/SSL connections with abnormal certificate chains or handshakes. Defender correlates process creation, module load, and unusual encrypted sessions.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Module LoadDC0016	WinEventLog:Sysmon	EventCode=7
Network Connection CreationDC0082	WinEventLog:Sysmon	EventCode=3, 22

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
AllowedCryptoProcesses	Whitelist browsers, mail clients, or apps expected to use asymmetric crypto.
CertificateAuthorityList	Baseline CA list for validating abnormal certs.
HandshakeTimeout	Detection of incomplete or malformed handshakes.

AN1497 · Linux

Processes (e.g., bash, python, custom binaries) dynamically linking libcrypto/libssl for RSA key exchange, then creating external connections with abnormal certificate validation or handshake anomalies. Defender observes syscall traces and outbound asymmetric key exchanges from non-SSL-native processes.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Module LoadDC0016	linux:osquery	Processes linked with libssl/libcrypto performing network activity
Process CreationDC0032	auditd:SYSCALL	execve or socket/connect system calls for processes using RSA handshake
Application Log ContentDC0038	linux:syslog	Non-standard processes negotiating SSL/TLS key exchanges

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
ExpectedCryptoLibs	Baseline libraries that normally handle asymmetric crypto.
TrafficAsymmetryRatio	Threshold for client-heavy data sending vs server.

AN1498 · macOS

Applications or launchd services invoking RSA or public-key routines from the Security framework, followed by outbound SSL/TLS sessions with unrecognized certs or anomalous handshakes. Defender observes unified logs of API calls and suspicious network entropy.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Process CreationDC0032	macos:unifiedlog	Process invoking SecKeyCreateRandomKey or asymmetric crypto APIs
Network Traffic ContentDC0085	macos:unifiedlog	TLS connections with abnormal handshake sequence or self-signed cert

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
TrustedDoHEndpoints	Known legitimate DoH/SSL endpoints.
PayloadEntropyThreshold	Entropy scoring for outbound payloads.

AN1499 · ESXi

VMware services (hostd, vpxa) unexpectedly negotiating asymmetric crypto sessions to external endpoints outside vCenter or update servers. Defender sees encrypted handshakes in logs inconsistent with baseline ESXi communication patterns.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Application Log ContentDC0038	esxi:vpxd	ESXi process initiating asymmetric handshake with external host
Network Traffic ContentDC0085	esxcli:network	Socket inspection showing RSA key exchange outside baseline endpoints

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
BaselineMgmtHosts	Expected external endpoints (vCenter, update repos).

AN1500 · Network Devices

Encrypted sessions detected with asymmetric key exchange anomalies on non-standard ports or with invalid/malformed certs. Defender correlates NetFlow/IPFIX with IDS/IPS detecting RSA exchanges outside expected TLS flows.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Network Traffic FlowDC0078	NSM:Flow	Flow records with RSA key exchange on unexpected port
Network Traffic ContentDC0085	IDS:TLSInspection	Malformed certs, incomplete asymmetric handshakes, or invalid CAs

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
PortProfiles	Define expected ports for asymmetric cryptography (e.g., 443, 993).
CertValidationPolicy	Thresholds for rejecting untrusted/self-signed certs.

Asymmetric Cryptography detections T1573.002

5 rules are mapped to this technique. Parent techniques also include their sub-techniques’ rules. Click a slice or key entry to filter the table.

64th pctamong all ATT&CK techniques for number of rules

Product

Severity

Library

Drag headers to reorder | Drag edges to resize

Loading detections...

Select	Title	Description	Category	Status	Event	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID	Refs