Quick links
Press Enter to search, Esc to close
Attack technique
Encrypted Channel is a technique where attackers encrypt the traffic they use to control a compromised system.
In short
Encrypted Channel is a technique where attackers encrypt the traffic they use to control a compromised system. The encryption hides what is being sent, so security tools that read network traffic see only scrambled data. MITRE ATT&CK tracks it as T1573 under Command and Control, and lists Emotet, gh0st RAT and NETWIRE as using it.
Command and Control · Step 13 Of 15 In The Attack Chain
After an attacker gains a foothold, the infected system needs to talk to a server the attacker controls. This is called command and control. If that traffic is readable, a network tool can match it against known patterns.
To avoid this, attackers encrypt the traffic with an encryption algorithm of their own choosing instead of relying only on the protection built into a normal protocol. Defenders then cannot easily read the commands or the data going out.
The method has a weakness. If the secret keys are stored or generated inside the malware or its configuration files, analysts who take the malware apart may be able to recover them.
MITRE lists two sub-techniques: T1573.001 Symmetric Cryptography and T1573.002 Asymmetric Cryptography.
Watch for processes that do not normally make network connections but open outbound encrypted sessions, especially to rare destinations or with non-standard certificate chains.
Look for encrypted sessions where the client sends much more than it receives, or the reverse, which can differ from normal browsing patterns.
Flow records or packet inspection can show encrypted traffic on ports that do not normally carry it, with high-entropy data.
DET0273, Detection Strategy for Encrypted Channel across OS Platforms.
Inspecting encrypted sessions lets defenders look for network signs of malware communication that would otherwise stay hidden.
Systems that use network signatures can help identify traffic from specific malware at the network level.
It is a technique where attackers encrypt the traffic between a compromised system and their own server. Defenders then cannot easily read the commands or the data going out. MITRE ATT&CK tracks it as T1573 under Command and Control.
Watch for processes that do not normally use the network but open outbound encrypted sessions to rare destinations. Lopsided traffic, where the client sends far more than it receives, and encryption on unusual ports are also warning signs.
Use SSL/TLS inspection to look inside encrypted sessions for signs of malware communication. Network intrusion detection and prevention systems with signatures can also help identify traffic from specific malware.
Encryption stops network tools from matching the traffic against known patterns. It has a weakness, though: if the secret keys are stored inside the malware or its configuration, analysts who take the malware apart may be able to recover them.
Take control of your digital security with an exclusive demo of our AI-driven threat intelligence platform.
