| ID | Name |
|---|---|
| T1521.001 | Symmetric Cryptography |
| T1521.002 | Asymmetric Cryptography |
| T1521.003 | SSL Pinning |
Adversaries may employ a known symmetric encryption algorithm to conceal command and control traffic, rather than relying on any inherent protections provided by a communication protocol. Symmetric encryption algorithms use the same key for plaintext encryption and ciphertext decryption. Common symmetric encryption algorithms include AES, Blowfish, and RC4.
| ID | Name | Description |
|---|---|---|
| C0033 | C0033 |
During C0033, PROMETHIUM used StrongPity to encrypt C2 communication using AES.[1] |
| S0478 | EventBot |
EventBot has encrypted base64-encoded payload data using RC4 and Curve25519.[2] |
| C0054 | Operation Triangulation |
During Operation Triangulation, the threat actors used 3DES and AES to encrypt C2 communication and data.[3][4] |
| S0411 | Rotexy | |
| S1055 | SharkBot | |
| S1216 | TriangleDB |
TriangleDB has encrypted data using 3DES.[3] |
| G0112 | Windshift |
Windshift has encrypted C2 communications using AES in CBC mode during Operation BULL and Operation ROCK.[7] |
This type of attack technique cannot be easily mitigated with preventive controls since it is based on the abuse of system features.
| ID | Name | Analytic ID | Analytic Description |
|---|---|---|---|
| DET0650 | Detection of Symmetric Cryptography | AN1731 |
An application performs repeated symmetric cryptographic operations (e.g., AES/RC4) on collected or staged data using locally accessible or reusable keys, followed by structured outbound communication. Detection correlates symmetric crypto API invocation + key reuse patterns + data staging + background execution context + network transmission, especially when inconsistent with expected application functionality. |
| AN1732 |
Indirect evidence of symmetric cryptographic channel usage inferred through repeated structured encrypted network transmissions and background processing patterns, where direct observation of symmetric crypto operations is limited. Detection correlates application background execution + consistent encrypted payload patterns + app entitlement posture to identify misuse of symmetric encryption for command and control. |