Encrypted Channel

Adversaries may explicitly employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if necessary secret keys are encoded and/or generated within malware samples/configuration files.

ID: T1521
Sub-techniques:  T1521.001, T1521.002, T1521.003
Tactic Type: Post-Adversary Device Access
Platforms: Android, iOS
Version: 2.0
Created: 01 October 2019
Last Modified: 24 October 2025

Procedure Examples

ID Name Description
S1095 AhRat

AhRat can communicate with the C2 using HTTPS requests.[1]

S0302 Twitoor

Twitoor encrypts its C2 communication.[2]

Mitigations

This type of attack technique cannot be easily mitigated with preventive controls since it is based on the abuse of system features.

Detection Strategy

ID Name Analytic ID Analytic Description
DET0641 Detection of Encrypted Channel AN1716

An application performs explicit cryptographic operations (e.g., symmetric/asymmetric encryption routines) on locally collected or generated data, followed by structured outbound network communication that does not align with expected application behavior, particularly when occurring in the background or without user interaction. Detection correlates crypto API usage + data staging + application state + network transmission patterns.

AN1717

Indirect evidence of application-layer encrypted channel usage inferred through anomalous background processing and network transmission patterns following application activity, where encryption operations are not directly observable. Detection correlates background execution + network behavior + application entitlement posture to identify misuse of encrypted communication channels.

References