| ID | Name |
|---|---|
| T1521.001 | Symmetric Cryptography |
| T1521.002 | Asymmetric Cryptography |
| T1521.003 | SSL Pinning |
Adversaries may employ a known symmetric encryption algorithm to conceal command and control traffic, rather than relying on any inherent protections provided by a communication protocol. Symmetric encryption algorithms use the same key for plaintext encryption and ciphertext decryption. Common symmetric encryption algorithms include AES, Blowfish, and RC4.
| ID | Name | Description |
|---|---|---|
| C0033 | C0033 |
During C0033, PROMETHIUM used StrongPity to encrypt C2 communication using AES.[1] |
| S0478 | EventBot |
EventBot has encrypted base64-encoded payload data using RC4 and Curve25519.[2] |
| S0411 | Rotexy | |
| S1055 | SharkBot | |
| G0112 | Windshift |
Windshift has encrypted C2 communications using AES in CBC mode during Operation BULL and Operation ROCK.[5] |
This type of attack technique cannot be easily mitigated with preventive controls since it is based on the abuse of system features.
Since data encryption is a common practice in many legitimate applications and uses standard programming language-specific APIs, encrypting data for command and control communication is regarded as undetectable to the user.