The sub-techniques beta is now live! Read the release blog post for more info.

Multilayer Encryption

An adversary performs C2 communications using multiple layers of encryption, typically (but not exclusively) tunneling a custom encryption scheme within a protocol encryption scheme such as HTTPS or SMTPS.

ID: T1079
Tactic: Command And Control
Platform: Linux, macOS, Windows
Data Sources: Packet capture, Process use of network, Malware reverse engineering, Process monitoring
Requires Network:  Yes
Version: 1.0
Created: 31 May 2017
Last Modified: 18 July 2019

Procedure Examples

Name Description

Hi-Zor encrypts C2 traffic with HTTPS and also encodes it with a single-byte XOR key.[4]


Pupy can use Obfs3, a pluggable transport, to add another layer of encryption and obfuscate TLS.[3]


Sykipot communicates using HTTPS and uses a custom encryption cipher to encrypt the HTTPS message body.[5]


Tor encapsulates traffic in multiple layers of encryption.[2]


WannaCry uses Tor for command and control traffic and routes a custom cryptographic protocol over the Tor circuit.[6]


Mitigation Description
Network Intrusion Prevention

Network intrusion detection and prevention systems that use network signatures to identify traffic for specific adversary malware can be used to mitigate activity at the network level. Use of encryption protocols may make typical network-based C2 detection more difficult due to a reduced ability to signature the traffic. Prior knowledge of adversary C2 infrastructure may be useful for domain and IP address blocking, but will likely not be an effective long-term solution because adversaries can change infrastructure often.[1]


If malware uses Standard Cryptographic Protocol, SSL/TLS inspection can be used to detect command and control traffic within some encrypted communication channels. [7] SSL/TLS inspection does come with certain risks that should be considered before implementing to avoid potential security issues such as incomplete certificate validation. [8] After SSL/TLS inspection, additional cryptographic analysis may be needed to analyze the second layer of encryption.

With Custom Cryptographic Protocol, if malware uses encryption with symmetric keys, it may be possible to obtain the algorithm and key from samples and use them to decode network traffic to detect malware communications signatures. [9]

In general, analyze network data for uncommon data flows (e.g., a client sending significantly more data than it receives from a server). Processes utilizing the network that do not normally have network communication or have never been seen before are suspicious. Analyze packet contents to detect communications that do not follow the expected protocol behavior for the port that is being used. [1]