T1600.001 — Reduce Key Space

Tactic: Defense Impairment · Platforms: Network Devices

Adversaries may reduce the level of effort required to decrypt data transmitted over the network by reducing the cipher strength of encrypted communications. Adversaries can weaken the encryption software on a compromised network device by reducing the key size used by the software to convert…

Sub-technique of Weaken Encryption (T1600).

Sigma detection rules (1)

T1600.001 Weaken Encryption: Reduce Key Space

title: "T1600.001 Weaken Encryption: Reduce Key Space"
id: 88bae9c0-b681-41bf-816d-d35dcd003b39
description: 'Detection Strategy for Weaken Encryption: Reduce Key Space on Network Devices. Now requires the touch of sshd_config/openssl.cnf to be an actual write-capable open (O_WRONLY/O_RDWR/O_TRUNC) rather than any PATH reference, since NORMAL-nametype PATH events alone cannot distinguish a plain read from a modification. auditd still cannot inspect file content, so it cannot on its own confirm the edit reduced (versus strengthened) cipher/key strength - pair with a FIM content diff against CipherSuiteBaseline/AllowedKeyLengths for that confirmation. Tune using: AllowedKeyLengths, CipherSuiteBaseline, AuthorizedAdminAccounts, TimeWindow.'
references:
  - https://attack.mitre.org/techniques/T1600/001
author: Shahrukh Khan
date: 2026-04-21
license: MIT
tags:
  - attack.defense-impairment
  - attack.t1600.001

logsource:
  category: file_change
  product: linux
  service: auditd

detection:
  selection_path:
    type: PATH
    name|contains:
      - '/etc/ssl/openssl.cnf'
      - '/etc/ssh/sshd_config'
  selection_write:
    type: SYSCALL
    syscall:
      - 'open'
      - 'openat'
    success: 'yes'
    a2|contains:
      - 'O_WRONLY'
      - 'O_RDWR'
      - 'O_TRUNC'

  condition: selection_path and selection_write

falsepositives:
  - Routine hardening or certificate renewal work also opens these files for writing from an authorized admin account; scope AuthorizedAdminAccounts and pair with a FIM content diff (CipherSuiteBaseline/AllowedKeyLengths) to confirm the edit actually reduced rather than strengthened the cipher/key configuration.

level: medium

Related sub-techniques

Explore