Adversaries may employ an encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
| ID | Name | Description |
|---|---|---|
| G0016 | APT29 |
APT29 has used multiple layers of encryption within malware to protect C2 communication.[1] |
| G1002 | BITTER | |
| S0631 | Chaes | |
| S0498 | Cryptoistic |
Cryptoistic can engage in encrypted communications with C2.[4] |
| S0367 | Emotet |
Emotet has encrypted data before sending to the C2 server.[5] |
| S0032 | gh0st RAT |
gh0st RAT has encrypted TCP communications to evade detection.[6] |
| C0035 | KV Botnet Activity |
KV Botnet Activity command and control activity includes transmission of an RSA public key in communication from the server, but this is followed by subsequent negotiation stages that represent a form of handshake similar to TLS negotiation.[7] |
| S0681 | Lizar |
Lizar can support encrypted communications between the client and server.[8][9] |
| S1016 | MacMa |
MacMa has used TLS encryption to initialize a custom protocol for C2 communications.[10] |
| G0059 | Magic Hound |
Magic Hound has used an encrypted http proxy in C2 communications.[11] |
| S0198 | NETWIRE | |
| S1012 | PowerLess |
PowerLess can use an encrypted channel for C2 communications.[13] |
| S1046 | PowGoop | |
| S0662 | RCSession |
RCSession can use an encrypted beacon to check in with C2.[15] |
| C0030 | Triton Safety Instrumented System Attack |
In the Triton Safety Instrumented System Attack, TEMP.Veles used cryptcat binaries to encrypt their traffic.[16] |
| G0081 | Tropic Trooper |
Tropic Trooper has encrypted traffic with the C2 to prevent network detection.[17] |
| ID | Mitigation | Description |
|---|---|---|
| M1031 | Network Intrusion Prevention |
Network intrusion detection and prevention systems that use network signatures to identify traffic for specific adversary malware can be used to mitigate activity at the network level. |
| M1020 | SSL/TLS Inspection |
SSL/TLS inspection can be used to see the contents of encrypted sessions to look for network-based indicators of malware communication protocols. |
| ID | Data Source | Data Component | Detects |
|---|---|---|---|
| DS0029 | Network Traffic | Network Traffic Content |
Monitor and analyze traffic patterns and packet inspection associated to protocol(s) that do not follow the expected protocol standards and traffic flows (e.g extraneous packets that do not belong to established flows, gratuitous or anomalous traffic patterns, anomalous syntax, or structure). Consider correlation with process monitoring and command line to detect anomalous processes execution and command line arguments associated to traffic patterns (e.g. monitor anomalies in use of files that do not normally initiate connections for respective protocol(s)). |