T1573.002No distinct observable

Asymmetric Cryptography

Command and ControlESXi, Linux, macOS, Network Devices, Windows

Where this stands

A reviewer read the telemetry and concluded there is nothing here to detect that a sibling technique does not already cover.

All three analytics (AN1496 Windows, AN1497 Linux, AN1498 macOS) key on inspecting TLS/SSL certificate chains, handshake anomalies or which asymmetric-crypto API/library a process invoked, but every log source the brief lists across all three platforms is metadata-only: Sysmon EventID 3/22 (network_connection, dns_query) carry only IPs, ports and queried names, never certificate content or handshake detail; Sysmon EventID 7 (image_load) names a loaded DLL but not what it was used for; auditd EXECVE, linux:syslog and macOS unifiedlog similarly carry process and connection metadata, not cipher or key-exchange detail. No field in any of these logsources can carry the actual distinguishing signal MITRE describes. […]

What the technique is

Adversaries may employ a known asymmetric encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Asymmetric cryptography, also known as public key cryptography, uses a keypair per party: one public that can be freely distributed, and one private. Due to how the keys are generated, the sender encrypts data with the receiver’s public key and the receiver decrypts the data with their private key. This ensures that only the intended recipient can read the encrypted data. Common public key encryption algorithms include RSA and ElGamal. For efficiency, many protocols (including SSL/TLS) use symmetric cryptography once a connection is established, but use asymmetric cryptography to establish or transmit a key. As such, these protocols are classified as Asymmetric Cryptography.

Read it on attack.mitre.org

What MITRE says you would watch

AN1496
Processes not typically associated with encryption loading asymmetric crypto libraries (e.g., rsaenh.dll, crypt32.dll) and subsequently initiating outbound TLS/SSL connections with abnormal certificate chains or handshakes. Defender correlates process creation, module load, and unusual encrypted sessions.
AN1497
Processes (e.g., bash, python, custom binaries) dynamically linking libcrypto/libssl for RSA key exchange, then creating external connections with abnormal certificate validation or handshake anomalies. Defender observes syscall traces and outbound asymmetric key exchanges from non-SSL-native processes.
AN1498
Applications or launchd services invoking RSA or public-key routines from the Security framework, followed by outbound SSL/TLS sessions with unrecognized certs or anomalous handshakes. Defender observes unified logs of API calls and suspicious network entropy.