T1573No distinct observable

Encrypted Channel

Command and ControlESXi, Linux, macOS, Network Devices, Windows

Where this stands

A reviewer read the telemetry and concluded there is nothing here to detect that a sibling technique does not already cover.

T1573 is the union of its two children and both are already declined in this corpus on grounds that apply verbatim to the parent: every discriminator in DET0273 is a per-session statistic or a piece of TLS handshake content that none of the offered log sources carries. AN0759 (Windows) asks for 'asymmetric traffic volumes (client sending more than receiving)' and 'non-standard certificate chains' over Sysmon EventID 3 (network_connection) and 22 (dns_query), which carry only IPs, ports, hostnames and queried names — no byte counts, no certificate content — and its EventID 7 (image_load) leg reduces to 'a process loaded a crypto DLL', which every browser, updater, mail client and OS service does continuously; that exact fallback is why T1573.001 and T1573.002 were both declined. […]

Covered instead by T1573.001, T1573.002.

What the technique is

Adversaries may employ an encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.

Read it on attack.mitre.org

What MITRE says you would watch

AN0759
Processes that normally do not initiate network connections establishing outbound encrypted TLS/SSL sessions, especially with asymmetric traffic volumes (client sending more than receiving) or non-standard certificate chains. Defender observations correlate process creation with unexpected network encryption libraries being loaded.
AN0760
Processes like curl, wget, python, socat, or custom binaries initiating TLS/SSL sessions to non-standard destinations. Defender sees abnormal syscalls for connect(), loading of libssl libraries, and persistent outbound encrypted traffic from daemons not normally communicating externally.
AN0761
Applications or launchd jobs initiating encrypted TLS traffic to rare external hosts. Defender observes unified logs showing ssl/TLS API calls by processes not baseline-approved, and payload entropy suggesting encrypted C2 sessions.