Cross-source coverage
T1600 / ATT&CK
Weaken Encryption
3 rules across 2 sources.
From MITRE ATT&CK 19.2
Adversaries may compromise a network device’s encryption capability in order to bypass encryption that would otherwise protect data communications.
Encryption can be used to protect transmitted network traffic to maintain its confidentiality (protect against unauthorized disclosure) and integrity (protect against unauthorized changes). Encryption ciphers are used to convert a plaintext message to ciphertext and can be computationally intensive to decipher without the associated decryption key. Typically, longer keys increase the cost of cryptanalysis, or decryption without the key.
Adversaries can compromise and manipulate devices that perform encryption of network traffic. For example, through behaviors such as Modify System Image, Reduce Key Space, and Disable Crypto Hardware, an adversary can negatively effect and/or eliminate a device’s ability to securely encrypt network traffic. This poses a greater risk of unauthorized disclosure and may help facilitate data manipulation, Credential Access, or Collection efforts.
- Tactics
- Defense Impairment
- Platforms
- Network Devices
- Telemetry
-
networkdevice:configNSM:Flowsnmp:status
How MITRE says to detect it DET0339
Detection Strategy for Weaken Encryption on Network Devices
Network Devices Analytic 0961
Defenders may observe unauthorized modifications to encryption-related configuration files, firmware, or crypto modules on network devices. Suspicious patterns include changes to cipher suite configurations, unexpected firmware updates affecting crypto libraries, disabling of hardware cryptographic accelerators, or reductions in key length policies. Correlating configuration changes with anomalies in encrypted traffic characteristics (e.g., weaker ciphers or sudden plaintext transmission) strengthens detection.
networkdevice:configConfiguration change events referencing encryption, TLS/SSL, or IPSec settingsNSM:FlowTraffic patterns showing downgrade from strong encryption (AES-256) to weaker or plaintext protocolssnmp:statusStatus change in cryptographic hardware modules (enabled -> disabled)
Sub-techniques with coverage
Counted in the 3 above — a rule tagged a sub-technique covers this technique too.
chronicle/detection-rules
2 rules| Detection | Severity | Format |
|---|---|---|
| aws_alb_insecure_ssl_policy | Low | YARA-L |
| aws_cloudfront_insecure_ssl_policy | Low | YARA-L |
panther-labs/panther-analysis
1 rule| Detection | Severity | Format |
|---|---|---|
| Slack Enterprise Key Management Unenrolled | Critical | Panther Python |