TA0011 · COMMAND AND CONTROL
Encrypted Channel
TLS or custom crypto wrapping the C2 channel so content inspection sees nothing.
Detect it with
JA3/JA3S fingerprints, self-signed certificates, TLS to IP addresses with no SNI.
Why it matters on shift
Encrypted Channel is one of the concrete ways adversaries achieve command and control. Recognising it in telemetry lets you name the technique in your ticket and pivot to what came before and after.
What to look for next
After command and control, the next tactic is usually Exfiltration. Search your telemetry for the transition before closing the ticket.
2 sub-techniques
How it shows up in practice
- T1573.001
Symmetric Cryptography
Adversaries may employ a known symmetric encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol.
- T1573.002
Asymmetric Cryptography
Adversaries may employ a known asymmetric encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol.
Kill-chain context