T1573Command and Control
Encrypted Channel
Adversaries may employ an encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
CVEs0
In CISA KEVThe US Cybersecurity and Infrastructure Security Agency’s list of Known Exploited Vulnerabilities. A CVE is added when CISA has evidence that attackers are using it.0
Reports0
Detections
6 Sigma rules tagged T1573Encrypted ChannelT15736 general rules
- Potential Pikabot C2 Activityhightest
- Kalambur Backdoor Curl TOR SOCKS Proxy Executionhighexperimental
- Activity from Anonymous IP Addressesmediumtest
- Activity from Infrequent Countrymediumtest
- Activity from Suspicious IP Addressesmediumtest
- Suspicious SSL Connectionlowtest
Sigma rules © SigmaHQ, Detection Rule License 1.1; linked, not reproduced.
CVEs linked to Encrypted Channel
0 CVEs, by priority. Each link shows its badge.No CVEs are linked to this technique yet.
Linked through a sub-technique
3 more- CVE-2021-40539Zoho ManageEngine ADSelfService Plus Authentication Bypass VulnerabilityZoho · ManageEngineKEVRansomwarePublic exploitCritical · 9.8T1190Exploit Public-Facing ApplicationT1047Windows Management Instrumentation+11 more · 1 report99.0%Top 0.07%83.7priority
- CVE-2021-40449Microsoft Windows Win32k Privilege Escalation VulnerabilityMicrosoft · WindowsKEVRansomwarePublic exploitHigh · 7.8T1566PhishingT1059.003Windows Command Shell+6 more81.9%Top 0.35%78.4priority
- CVE-2021-44077Zoho ManageEngine ServiceDesk Plus Remote Code Execution VulnerabilityZoho · ManageEngine ServiceDesk Plus (SDP) / SupportCenter PlusKEVPublic exploitCritical · 9.8T1190Exploit Public-Facing ApplicationT1047Windows Management Instrumentation+11 more93.3%Top 0.16%69.8priority