T1573.002 — Asymmetric Cryptography

Tactic: Command and Control · Platforms: ESXi, Linux, macOS, Network Devices, Windows

Adversaries may employ a known asymmetric encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Asymmetric cryptography, also known as public key cryptography, uses a keypair per party: one public that can…

Sub-technique of Encrypted Channel (T1573).

Sigma detection rules (5)

title: "T1573.002 Encrypted Channel: Asymmetric Cryptography"
id: b34a7b08-8191-4cdd-8b67-d0ba94fee2da
description: 'Detection Strategy for Encrypted Channel via Asymmetric Cryptography across OS Platforms. (Data Component: Module Load; baseline tier: windows-eventid.) Tune using: AllowedCryptoProcesses, CertificateAuthorityList, HandshakeTimeout.'
references:
  - https://attack.mitre.org/techniques/T1573/002
author: Shahrukh Khan
date: 2026-06-18
license: MIT
tags:
  - attack.command-and-control
  - attack.t1573.002

logsource:
  category: image_load
  product: windows
  service: sysmon

detection:
  selection:
    EventID: '7'

  selection_asymmetric_module:
    ImageLoaded|endswith:
      - '\ncrypt.dll'
      - '\ncryptsslp.dll'
      - '\dssenh.dll'

  selection_uncommon_host:
    Image|endswith:
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\mshta.exe'
      - '\rundll32.exe'
      - '\regsvr32.exe'
      - '\certutil.exe'
      - '\wmic.exe'

  filter_system_account:
    User|contains:
      - 'SYSTEM'
      - 'LOCAL SERVICE'
      - 'NETWORK SERVICE'

  condition: selection and selection_asymmetric_module and selection_uncommon_host and not filter_system_account

falsepositives:
  - Legitimate scripts or admin tooling that legitimately load CNG asymmetric/key-storage modules from a scripting host.

level: medium

title: "T1573.002 Encrypted Channel: Asymmetric Cryptography"
id: 5031b14a-cac5-4e32-8b38-30d3510860db
description: 'T1573.002 describes malware using asymmetric cryptography inside an implemented C2 network channel -- a network-protocol/TLS-level behavior that auditd process/file telemetry cannot directly observe (no certificate, handshake, or payload-encryption inspection is available from EXECVE/SYSCALL/PATH records). This rule implements the closest defensible auditd-observable proxy: a process invoking openssl for a manual asymmetric encrypt/decrypt operation (rsautl/pkeyutl) that, in the same audited execution, also performs a successful outbound connect() syscall -- i.e. local asymmetric-crypto tooling used in temporal proximity to a network connection attempt by the same process. This is a coarse heuristic, not confirmation of an actual C2 channel, and will miss the common case where a malware sample implements its own crypto natively rather than shelling out to openssl; for real coverage, network/TLS telemetry (certificate anomalies, JA3/JA3S, non-standard ports) is required.'
references:
  - https://attack.mitre.org/techniques/T1573/002
author: Shahrukh Khan
date: 2026-06-19
license: MIT
tags:
  - attack.command-and-control
  - attack.t1573.002

logsource:
  category: process_creation
  product: linux
  service: auditd

detection:
  selection_asymmetric_op:
    type: EXECVE
    exe|endswith: '/openssl'
    a1|contains:
      - 'rsautl'
      - 'pkeyutl'
    a2|contains: '-encrypt'
  selection_network_connect:
    type: SYSCALL
    syscall: connect
    success: 'yes'
  condition: selection_asymmetric_op and selection_network_connect

falsepositives:
  - Legitimate deployment/signing tooling that both encrypts an artifact with openssl and separately makes network calls (e.g. uploading the encrypted artifact) within the same audited process tree; treat as a low-confidence heuristic requiring further network-layer corroboration.

level: low

title: "T1573.002 Encrypted Channel: Asymmetric Cryptography"
id: dca6212b-d7d2-4283-8677-df22c8a8fef1
description: 'Detection Strategy for Encrypted Channel via Asymmetric Cryptography across OS Platforms. (Retargeted to the process_creation macOS unified-log telemetry that actually captures this techniques behavior; see logsource below.) Tune using: TrustedDoHEndpoints, PayloadEntropyThreshold.'
references:
  - https://attack.mitre.org/techniques/T1573/002
author: Shahrukh Khan
date: 2026-05-25
license: MIT
tags:
  - attack.command-and-control
  - attack.t1573.002

logsource:
  category: process_creation
  product: macos

detection:
  selection:
    Image|endswith: '/openssl'
    CommandLine|contains|all:
      - 's_client'
      - '-connect'

  condition: selection

falsepositives:
  - Administrators and developers routinely use openssl s_client to manually test TLS endpoints during troubleshooting.

level: low

title: "T1573.002 Encrypted Channel: Asymmetric Cryptography"
id: 245072c0-60fd-4367-a12e-728a9c88dd8e
description: 'Detection Strategy for Encrypted Channel via Asymmetric Cryptography across OS Platforms. (Data Component: Network Traffic Flow; baseline tier: fallback.) Tune using: PortProfiles, CertValidationPolicy.'
references:
  - https://attack.mitre.org/techniques/T1573/002
author: Shahrukh Khan
date: 2026-03-10
license: MIT
tags:
  - attack.command-and-control
  - attack.t1573.002

logsource:
  product: nsm
  service: flow

detection:
  selection_selfsigned:
    validation_status|contains: 'self signed certificate'
  selection_nonstandard_port:
    id.resp_p:
      - 443
      - 8443
      - 4443
  condition: selection_selfsigned and selection_nonstandard_port

falsepositives:
  - Internally issued self-signed certificates for legitimate management interfaces or development and test services are a common source of matches.

level: medium

title: "T1573.002 Encrypted Channel: Asymmetric Cryptography"
id: 1d933c7d-cc01-40cc-b848-ff0890ab7e58
description: 'Detection Strategy for Encrypted Channel via Asymmetric Cryptography across OS Platforms. (Retargeted to the process_creation ESXi telemetry that actually captures this techniques behavior; see logsource below.) Tune using: BaselineMgmtHosts.'
references:
  - https://attack.mitre.org/techniques/T1573/002
author: Shahrukh Khan
date: 2026-06-03
license: MIT
tags:
  - attack.command-and-control
  - attack.t1573.002

logsource:
  product: esxi
  service: auth

detection:
  selection:
    Message|contains: 'Accepted publickey'

  condition: selection

falsepositives:
  - Legitimate key-based SSH administration from an expected jump host; auth.log captures the authentication event but not the asymmetric key exchange used by any subsequent tunneled C2 channel, so this only weakly correlates against a BaselineMgmtHosts allowlist.

level: low

Related sub-techniques

• T1573.001 Symmetric Cryptography

Explore

• All Sigma rules for MITRE ATT&CK
• Sigma rule format guide
• Full T1573.002 intelligence — ATT&CK Intelligence View
• Official MITRE ATT&CK entry
• Built by Shahrukh Khan