T1573.001 — Symmetric Cryptography

Tactic: Command and Control · Platforms: ESXi, Linux, macOS, Network Devices, Windows

Adversaries may employ a known symmetric encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Symmetric encryption algorithms use the same key for plaintext encryption and ciphertext decryption. Common…

Sub-technique of Encrypted Channel (T1573).

Sigma detection rules (5)

title: "T1573.001 Encrypted Channel: Symmetric Cryptography"
id: e3fd1d28-6dc0-4a73-b302-a5aea6808b40
description: 'Detection Strategy for Encrypted Channel via Symmetric Cryptography across OS Platforms. (Data Component: Module Load; baseline tier: windows-eventid.) Tune using: AllowedCryptoProcesses, EntropyThreshold, TimeWindow.'
references:
  - https://attack.mitre.org/techniques/T1573/001
author: Shahrukh Khan
date: 2026-05-20
license: MIT
tags:
  - attack.command-and-control
  - attack.t1573.001

logsource:
  category: image_load
  product: windows
  service: sysmon

detection:
  selection:
    EventID: '7'

  selection_symmetric_module:
    ImageLoaded|endswith:
      - '\bcrypt.dll'
      - '\bcryptprimitives.dll'
      - '\rsaenh.dll'
      - '\cryptsp.dll'

  selection_uncommon_host:
    Image|endswith:
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\mshta.exe'
      - '\rundll32.exe'
      - '\regsvr32.exe'
      - '\certutil.exe'
      - '\wmic.exe'

  filter_system_account:
    User|contains:
      - 'SYSTEM'
      - 'LOCAL SERVICE'
      - 'NETWORK SERVICE'

  condition: selection and selection_symmetric_module and selection_uncommon_host and not filter_system_account

falsepositives:
  - Legitimate scripts or admin tooling that legitimately load CNG/CryptoAPI symmetric modules from a scripting host.

level: medium

title: "T1573.001 Encrypted Channel: Symmetric Cryptography"
id: e8873a34-f8c0-4529-8dba-fec2e2e0cabc
description: 'Detection Strategy for Encrypted Channel via Symmetric Cryptography. The original rule matched "openssl enc -k", which performs local file encryption and never touches a network connection, so it could not represent an encrypted C2 channel (and was an exact copy of the unrelated Archive-via-Custom-Method rule). Retargeted to openssl s_client/s_server invocations, the openssl subcommands that actually establish or serve a live network connection wrapped in symmetric/TLS encryption. Tune using: TrustedCryptoLibs, TrafficAsymmetryRatio.'
references:
  - https://attack.mitre.org/techniques/T1573/001
author: Shahrukh Khan
date: 2026-01-10
license: MIT
tags:
  - attack.command-and-control
  - attack.t1573.001

logsource:
  category: process_creation
  product: linux

detection:
  selection_s_client:
    type: EXECVE
    a0|endswith: '/openssl'
    a1|contains: 's_client'
  selection_s_server:
    type: EXECVE
    a0|endswith: '/openssl'
    a1|contains: 's_server'

  condition: 1 of selection_*

falsepositives:
  - Administrators and monitoring scripts legitimately use openssl s_client/s_server to test or debug TLS endpoints; traffic asymmetry ratio, the strongest true C2 indicator, still cannot be computed from process-creation telemetry alone and would need a network-flow source.

level: medium

title: "T1573.001 Encrypted Channel: Symmetric Cryptography"
id: a9bf5172-7b80-47fe-9534-bf09f9d28661
description: 'Detection Strategy for Encrypted Channel via Symmetric Cryptography across OS Platforms. (Retargeted to the process_creation macOS unified-log telemetry that actually captures this techniques behavior; see logsource below.) Tune using: DoHResolvers, PayloadEntropyThreshold.'
references:
  - https://attack.mitre.org/techniques/T1573/001
author: Shahrukh Khan
date: 2026-03-07
license: MIT
tags:
  - attack.command-and-control
  - attack.t1573.001

logsource:
  category: process_creation
  product: macos

detection:
  selection:
    Image|endswith: '/openssl'
    CommandLine|contains|all:
      - 'enc'
      - '-k'

  condition: selection

falsepositives:
  - The choice of symmetric versus asymmetric cipher inside a C2 channel is invisible in process or network metadata; this rule only flags manual openssl invocations and will miss encryption performed inside a compiled implant.

level: low

title: "T1573.001 Encrypted Channel: Symmetric Cryptography"
id: 246f9d92-935a-4786-85b9-95d7af71265d
description: 'Detection Strategy for Encrypted Channel via Symmetric Cryptography across OS Platforms. (Data Component: Network Traffic Flow; baseline tier: fallback.) Tune using: PortProfiles, TrafficVolumeThreshold.'
references:
  - https://attack.mitre.org/techniques/T1573/001
author: Shahrukh Khan
date: 2026-06-15
license: MIT
tags:
  - attack.command-and-control
  - attack.t1573.001

logsource:
  product: nsm
  service: flow

detection:
  selection_ssl_nonstandard:
    service: 'ssl'
    id.resp_p|lte: 1023
  selection_volume:
    orig_bytes|gte: 5000000
  condition: selection_ssl_nonstandard and selection_volume

falsepositives:
  - Legitimate encrypted services deliberately hosted on low, non-default ports for internal segmentation reasons will also match.

level: medium

title: "T1573.001 Encrypted Channel: Symmetric Cryptography"
id: 32d445d5-6f45-471e-a363-29644dc59f60
description: 'Detection Strategy for Encrypted Channel via Symmetric Cryptography across OS Platforms. (Retargeted to the process_creation ESXi telemetry that actually captures this techniques behavior; see logsource below.) Tune using: AllowedMgmtHosts.'
references:
  - https://attack.mitre.org/techniques/T1573/001
author: Shahrukh Khan
date: 2026-01-16
license: MIT
tags:
  - attack.command-and-control
  - attack.t1573.001

logsource:
  product: esxi
  service: vpxd

detection:
  selection:
    Message|contains:
      - 'SSL'
      - 'cipher'

  condition: selection

falsepositives:
  - Symmetric cipher negotiation details are not meaningfully exposed in vpxd.log text; this rule can only flag generic SSL-related log lines and requires a network sensor to actually distinguish an attacker-controlled symmetric encrypted channel from AllowedMgmtHosts traffic.

level: low

Related sub-techniques

• T1573.002 Asymmetric Cryptography

Explore

• All Sigma rules for MITRE ATT&CK
• Sigma rule format guide
• Full T1573.001 intelligence — ATT&CK Intelligence View
• Official MITRE ATT&CK entry
• Built by Shahrukh Khan