tfMITRE ATT&CK technique

Weaken Encryption T1600

Tactic: Defense Impairment
Platform: Network Devices
Version: 2.0
Created: 19 October 2020
Last modified: 12 May 2026

Sub-techniques 20 rules across the family · 0 mapped directly to T1600 · 0 of 2 carry rules

.001Reduce Key Space0 .002Disable Crypto Hardware0

Adversaries may compromise a network device’s encryption capability in order to bypass encryption that would otherwise protect data communications.[1]

ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact

Threat groupsNone recorded

Threat groupsNone recorded · 29% of ATT&CK techniques have none either.

CampaignsNone recorded

CampaignsNone recorded · 54% of ATT&CK techniques have none either.

Tools & malwareNone recorded

Tools & malwareNone recorded · 29% of ATT&CK techniques have none either.

Detection rulesNone recorded

Detection rulesNone recorded · 32% of ATT&CK techniques have none either.

Offense vs defense T1600

Compare defenses against adversary use. Eight counts, ranking this technique against the entire ATT&CK Enterprise matrix. Attack sits left, defense right.

Data component	Name	Channel
Module LoadDC0016	snmp:status	Status change in cryptographic hardware modules (enabled -> disabled)
File ModificationDC0061	networkdevice:config	Configuration change events referencing encryption, TLS/SSL, or IPSec settings
Network Traffic ContentDC0085	NSM:Flow	Traffic patterns showing downgrade from strong encryption (AES-256) to weaker or plaintext protocols

Data component

Name

Channel

Module LoadDC0016

snmp:status

Status change in cryptographic hardware modules (enabled -> disabled)

File ModificationDC0061

networkdevice:config

Configuration change events referencing encryption, TLS/SSL, or IPSec settings

Network Traffic ContentDC0085

NSM:Flow

Traffic patterns showing downgrade from strong encryption (AES-256) to weaker or plaintext protocols

Field	What you tune
CipherSuiteWhitelist	List of approved encryption algorithms and key lengths; customizable to organizational policy.
TimeWindow	Correlation period between configuration changes and abnormal traffic; adjustable to reduce false positives.
AuthorizedFirmwareSources	Known trusted sources of firmware updates; deviations indicate possible compromise.
TrafficEntropyThreshold	Baseline entropy measurements of encrypted traffic; deviations may reveal weakening of encryption.

Field

What you tune

CipherSuiteWhitelist

List of approved encryption algorithms and key lengths; customizable to organizational policy.

TimeWindow

Correlation period between configuration changes and abnormal traffic; adjustable to reduce false positives.

AuthorizedFirmwareSources

Known trusted sources of firmware updates; deviations indicate possible compromise.

TrafficEntropyThreshold

Baseline entropy measurements of encrypted traffic; deviations may reveal weakening of encryption.

Offense vs defense T1600

Compare defenses against adversary use. Eight counts, ranking this technique against the entire ATT&CK Enterprise matrix. Attack sits left, defense right.

Data component	Name	Channel
Module LoadDC0016	snmp:status	Status change in cryptographic hardware modules (enabled -> disabled)
File ModificationDC0061	networkdevice:config	Configuration change events referencing encryption, TLS/SSL, or IPSec settings
Network Traffic ContentDC0085	NSM:Flow	Traffic patterns showing downgrade from strong encryption (AES-256) to weaker or plaintext protocols

Data component

Name

Channel

Module LoadDC0016

snmp:status

Status change in cryptographic hardware modules (enabled -> disabled)

File ModificationDC0061

networkdevice:config

Configuration change events referencing encryption, TLS/SSL, or IPSec settings

Network Traffic ContentDC0085

NSM:Flow

Traffic patterns showing downgrade from strong encryption (AES-256) to weaker or plaintext protocols

Field	What you tune
CipherSuiteWhitelist	List of approved encryption algorithms and key lengths; customizable to organizational policy.
TimeWindow	Correlation period between configuration changes and abnormal traffic; adjustable to reduce false positives.
AuthorizedFirmwareSources	Known trusted sources of firmware updates; deviations indicate possible compromise.
TrafficEntropyThreshold	Baseline entropy measurements of encrypted traffic; deviations may reveal weakening of encryption.

Field

What you tune

CipherSuiteWhitelist

List of approved encryption algorithms and key lengths; customizable to organizational policy.

TimeWindow

Correlation period between configuration changes and abnormal traffic; adjustable to reduce false positives.

AuthorizedFirmwareSources

Known trusted sources of firmware updates; deviations indicate possible compromise.

TrafficEntropyThreshold

Baseline entropy measurements of encrypted traffic; deviations may reveal weakening of encryption.

Select	Title	Description	Category	Status	Event	OS	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID	Refs
No rules found. Try adjusting your filters.

Title

Description

Weaken Encryption T1600

Weaken Encryption T1600

Offense vs defense T1600

Weaken Encryption detection strategy DET0339

Detection Strategy for Weaken Encryption on Network Devices

Log sources

Tunable fields

Offense vs defense T1600

Weaken Encryption detection strategy DET0339

Detection Strategy for Weaken Encryption on Network Devices

Log sources

Tunable fields

Weaken Encryption detections T1600

Weaken Encryption detections T1600