| ID | Name |
|---|---|
| T1521.001 | Symmetric Cryptography |
| T1521.002 | Asymmetric Cryptography |
| T1521.003 | SSL Pinning |
Adversaries may employ a known symmetric encryption algorithm to conceal command and control traffic, rather than relying on any inherent protections provided by a communication protocol. Symmetric encryption algorithms use the same key for plaintext encryption and ciphertext decryption. Common symmetric encryption algorithms include AES, Blowfish, and RC4.
| ID | Name | Description |
|---|---|---|
| C0033 | C0033 |
During C0033, PROMETHIUM used StrongPity to encrypt C2 communication using AES.[1] |
| S0478 | EventBot |
EventBot has encrypted base64-encoded payload data using RC4 and Curve25519.[2] |
| C0054 | Operation Triangulation |
During Operation Triangulation, the threat actors used 3DES and AES to encrypt C2 communication and data.[3][4] |
| S0411 | Rotexy | |
| S1055 | SharkBot | |
| S1216 | TriangleDB |
TriangleDB has encrypted data using 3DES.[3] |
| G0112 | Windshift |
Windshift has encrypted C2 communications using AES in CBC mode during Operation BULL and Operation ROCK.[7] |
This type of attack technique cannot be easily mitigated with preventive controls since it is based on the abuse of system features.
| ID | Name | Analytic ID | Analytic Description |
|---|---|---|---|
| DET0650 | Detection of Symmetric Cryptography | AN1731 |
Since data encryption is a common practice in many legitimate applications and uses standard programming language-specific APIs, encrypting data for command and control communication is regarded as undetectable to the user. |
| AN1732 |
Since data encryption is a common practice in many legitimate applications and uses standard programming language-specific APIs, encrypting data for command and control communication is regarded as undetectable to the user. |