T1573.001No distinct observable

Symmetric Cryptography

Command and ControlESXi, Linux, macOS, Network Devices, Windows

Where this stands

A reviewer read the telemetry and concluded there is nothing here to detect that a sibling technique does not already cover.

Every analytic's discriminator is a statistic no offered log source carries. Windows AN0400 pairs a crypto-DLL load (bcryptprimitives.dll, aes.dll — loaded by essentially any process that ever does TLS, including every browser and the OS itself) with an 'EntropyThreshold' on the following connection; Sigma has no payload-entropy field on Sysmon EventID 3/22, so the DLL-load half alone is what would remain, and it matches almost universally. Linux AN0401 and macOS AN0402 are the same shape: 'TrafficAsymmetryRatio' and 'PayloadEntropyThreshold' are per-session statistics, not fields on auditd execve/connect or macOS unifiedlog records, and neither brief log source carries them. […]

Covered instead by T1573, T1573.002.

What the technique is

Adversaries may employ a known symmetric encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Symmetric encryption algorithms use the same key for plaintext encryption and ciphertext decryption. Common symmetric encryption algorithms include AES, DES, 3DES, Blowfish, and RC4.

Read it on attack.mitre.org

What MITRE says you would watch

AN0400
Processes that typically do not perform cryptographic operations loading symmetric encryption libraries (e.g., bcryptprimitives.dll, aes.dll), then initiating outbound connections with high-entropy payloads. Defender correlates process creation, DLL load, and anomalous encrypted traffic patterns.
AN0401
Unexpected processes (e.g., bash, python, custom binaries) dynamically loading libcrypto or performing AES/RC4 encryption operations, then initiating outbound sessions with abnormal byte entropy or asymmetric traffic patterns.
AN0402
Launchd jobs or user processes invoking symmetric crypto APIs from the Security framework and generating outbound connections carrying randomized payloads inconsistent with normal TLS patterns.