Cross-source coverage
T1600.001 / ATT&CK
Weaken Encryption: Reduce Key Space
2 rules across 1 source.
From MITRE ATT&CK 19.2
Adversaries may reduce the level of effort required to decrypt data transmitted over the network by reducing the cipher strength of encrypted communications.
Adversaries can weaken the encryption software on a compromised network device by reducing the key size used by the software to convert plaintext to ciphertext (e.g., from hundreds or thousands of bytes to just a couple of bytes). As a result, adversaries dramatically reduce the amount of effort needed to decrypt the protected information without the key.
Adversaries may modify the key size used and other encryption parameters using specialized commands in a Network Device CLI introduced to the system through Modify System Image to change the configuration of the device.
- Tactics
- Defense Impairment
- Platforms
- Network Devices
- Telemetry
-
networkdevice:confignetworkdevice:cliNSM:Flow
How MITRE says to detect it DET0243
Detection Strategy for Weaken Encryption: Reduce Key Space on Network Devices
Network Devices Analytic 0681
Defenders may observe attempts to alter cryptographic settings on network devices that reduce key strength or allowable cipher suites. Suspicious indicators include configuration changes that downgrade encryption algorithms, key length parameters, or the disabling of strong encryption in favor of legacy ciphers. These activities often appear as CLI commands modifying crypto policies, firmware changes affecting crypto libraries, or unexpected updates to key management files. Correlation across device config logs and traffic analysis showing weaker ciphers provides higher confidence of malicious key space reduction.
networkdevice:configConfiguration changes referencing 'crypto', 'key length', 'cipher', or downgrade of encryption settingsnetworkdevice:cliExecution of CLI commands altering crypto parameters (e.g., 'crypto key generate rsa modulus 512')NSM:FlowObserved downgrade in negotiated cipher suites or TLS/SSH versions across sessions
chronicle/detection-rules
2 rules| Detection | Severity | Format |
|---|---|---|
| aws_alb_insecure_ssl_policy | Low | YARA-L |
| aws_cloudfront_insecure_ssl_policy | Low | YARA-L |