T1600.002 — Disable Crypto Hardware

Tactic: Defense Impairment · Platforms: Network Devices

Adversaries disable a network device’s dedicated hardware encryption, which may enable them to leverage weaknesses in software encryption in order to reduce the effort involved in collecting, manipulating, and exfiltrating transmitted data. Many network devices such as routers, switches, and…

Sub-technique of Weaken Encryption (T1600).

Sigma detection rules (1)

T1600.002 Weaken Encryption: Disable Crypto Hardware

title: "T1600.002 Weaken Encryption: Disable Crypto Hardware"
id: eb4d6833-c345-45cc-978d-c2f76b98a2be
description: 'T1600.002 targets dedicated hardware crypto ASICs on network appliances (routers, switches, firewalls). The prior openssl "engine ... disable" invocation is fabricated, non-standard CLI syntax unrelated to that hardware-disable behavior. On a Linux-based network device, the closest genuinely observable proxy for disabling dedicated crypto hardware is unloading the kernel driver module that exposes the hardware crypto accelerator (for example aesni_intel, ccp, qat, cesa) via rmmod or modprobe -r, forcing encryption onto software running on the general-purpose CPU. Tune using: AuthorizedAdminAccounts, ApprovedFirmwareVersions, TimeWindow.'
references:
  - https://attack.mitre.org/techniques/T1600/002
author: Shahrukh Khan
date: 2026-02-21
license: MIT
tags:
  - attack.defense-impairment
  - attack.t1600.002

logsource:
  category: process_creation
  product: linux
  service: auditd

detection:
  selection_unload:
    type: EXECVE
    a0|endswith:
      - '/rmmod'
    a1|contains:
      - 'aesni'
      - 'ccp'
      - 'qat'
      - 'cesa'
      - 'crypto4xx'
      - 'crypto'
  selection_remove_flag:
    type: EXECVE
    a0|endswith: '/modprobe'
    a1: '-r'
    a2|contains:
      - 'aesni'
      - 'ccp'
      - 'qat'
      - 'cesa'
      - 'crypto4xx'
      - 'crypto'

  condition: selection_unload or selection_remove_flag

falsepositives:
  - Kernel module reload during driver upgrade/maintenance, or legitimate migration off a deprecated hardware crypto accelerator, though this is rare in steady-state operations.

level: high

Related sub-techniques

Explore