T1573 · Encrypted Channel

Sunturai

Detections can measure how the public catalogue is used — which detections people look for, and which pages bring them here. It sets a cookie that recognises this browser for 180 days. It is never linked to an account and never follows you to other sites. Privacy notice

T1573 · Encrypted Channel · Sunturai

attack-patternenterprise-attackT1573

Encrypted Channel

attack-pattern--b8902400-e6c5-4ba2-95aa-2d35b442b118

Adversaries may employ an encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.

Created: Mar 16, 2020, 3:33 PM UTC
Modified: Oct 24, 2025, 5:49 PM UTC

2 sub-techniques under this technique

Each is its own technique in the catalogue, with its own detections.

23 published detections cover this technique

Every one carries the source it came from and the licence it was published under.

Detections covering this technique
Detection	Severity	Source	Published	Licence
Connection to Commonly Abused Free SSL Certificate Providers	Low	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
Deprecated TLS Version or Weak Cipher Negotiated Externally	Medium	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
Potential Self-Signed TLS Certificate Recently Issued on External Connection	Medium	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
Newly Observed IPSEC NAT Traversal Peer	Low	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
Default Cobalt Strike Team Server Certificate	High	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
Openssl Client or Server Activity	Medium	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
Detect DNS queries reporting multiple errors from different clients - Anomaly Based (ASIM DNS Solution)	Medium	Microsoft Sentinel analytics	Sep 10, 2026	MIT License
Cisco Cloud Security - Connection to non-corporate private network	Medium	—	Sep 4, 2026	MIT License
Ubiquiti - Unusual traffic	Medium	Microsoft Sentinel analytics	Sep 1, 2026	MIT License
ProofpointPOD - Weak ciphers	Low	Microsoft Sentinel analytics	Sep 1, 2026	MIT License
Potential beaconing activity (ASIM DNS Solution)	Unknown	Microsoft Sentinel analytics	Sep 1, 2026	MIT License
Detect DNS queries reporting multiple errors from different clients - Static threshold based (ASIM DNS Solution)	Medium	Microsoft Sentinel analytics	Sep 1, 2026	MIT License
CYFIRMA - Medium severity Command & Control Network Indicators with Monitor Recommendation Rule	Medium	Microsoft Sentinel analytics	Aug 29, 2026	MIT License
CYFIRMA - High severity Command & Control Network Indicators with Monitor Recommendation Rule	High	Microsoft Sentinel analytics	Aug 29, 2026	MIT License
CYFIRMA - Medium severity Command & Control Network Indicators with Block Recommendation Rule	Medium	Microsoft Sentinel analytics	Aug 29, 2026	MIT License
CYFIRMA - High severity Command & Control Network Indicators with Block Recommendation Rule	High	Microsoft Sentinel analytics	Aug 29, 2026	MIT License
Deprecated - Potential Non-Standard Port HTTP/HTTPS connection	Low	Elastic detection rules	Aug 27, 2026	Elastic License 2.0
Zeek x509 Certificate with Punycode	Medium	Splunk security content	Aug 26, 2026	Apache License 2.0
SSL Certificates with Punycode	Medium	Splunk security content	Aug 26, 2026	Apache License 2.0
Suspicious SSL Connection	Low	SigmaHQ	Aug 26, 2026	Detection Rule License 1.1
Activity from Infrequent Country	Medium	SigmaHQ	Aug 26, 2026	Detection Rule License 1.1
Activity from Anonymous IP Addresses	Medium	SigmaHQ	Aug 26, 2026	Detection Rule License 1.1
Activity from Suspicious IP Addresses	Medium	SigmaHQ	Aug 26, 2026	Detection Rule License 1.1

Showing 23 of 23

Filter in the catalogue

External references

mitre-attackT1573Open reference

SANS Decrypting SSL

SEI SSL Inspection RisksOpen reference

University of Birmingham C2Open reference

Platforms

ESXiLinuxmacOSNetwork DevicesWindows

Kill chain phases

command-and-control

Relationships

Incoming and outgoing edges in the selected ATT&CK release.

Incoming and outgoing edges in the selected ATT&CK release
Direction	Type	Related object