Cross-source coverage

T1573.001 / ATT&CK

Encrypted Channel: Symmetric Cryptography

0 rules across 0 sources.

1 deprecated hidden · include

From MITRE ATT&CK 19.2

Adversaries may employ a known symmetric encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Symmetric encryption algorithms use the same key for plaintext encryption and ciphertext decryption. Common symmetric encryption algorithms include AES, DES, 3DES, Blowfish, and RC4.

Tactics: Command and Control
Platforms: ESXi · Linux · macOS · Network Devices · Windows
Telemetry: WinEventLog:Sysmonauditd:SYSCALLlinux:sysloglinux:osquerymacos:unifiedlogesxi:vpxdesxcli:networkNSM:FlowNSM:Connections

How MITRE says to detect it DET0143

Detection Strategy for Encrypted Channel via Symmetric Cryptography across OS Platforms

Windows Analytic 0400

Processes that typically do not perform cryptographic operations loading symmetric encryption libraries (e.g., bcryptprimitives.dll, aes.dll), then initiating outbound connections with high-entropy payloads. Defender correlates process creation, DLL load, and anomalous encrypted traffic patterns.

WinEventLog:Sysmon EventCode=7
WinEventLog:Sysmon EventCode=3, 22

Linux Analytic 0401

Unexpected processes (e.g., bash, python, custom binaries) dynamically loading libcrypto or performing AES/RC4 encryption operations, then initiating outbound sessions with abnormal byte entropy or asymmetric traffic patterns.

auditd:SYSCALL execve or socket/connect system calls from processes using crypto libraries
linux:syslog System daemons initiating encrypted sessions with unexpected destinations
linux:osquery Process linked with libcrypto.so making external connections

macOS Analytic 0402

Launchd jobs or user processes invoking symmetric crypto APIs from the Security framework and generating outbound connections carrying randomized payloads inconsistent with normal TLS patterns.

macos:unifiedlog Process using AES/RC4 routines unexpectedly
macos:unifiedlog Encrypted connection with anomalous payload entropy

ESXi Analytic 0403

ESXi daemons (hostd, vpxa) unexpectedly using symmetric encryption routines for external connections. Defender identifies logs of service traffic with encrypted payloads inconsistent with VMware management baselines.

esxi:vpxd Symmetric crypto routines triggered for external session
esxcli:network Socket sessions with randomized payloads inconsistent with TLS

Network Devices Analytic 0404

Flows showing encrypted payloads with high entropy not matching TLS handshake patterns, particularly when occurring on non-standard ports. Defender observes NetFlow/IPFIX byte distribution anomalies or IDS/IPS detecting symmetric encryption patterns without associated key exchange.

NSM:Flow Flow records with entropy signatures resembling symmetric encryption
NSM:Connections Symmetric encryption detected without TLS handshake sequence

View on attack.mitre.org ↗

No live rules cover this technique. 1 deprecated rule is hidden.