TA0011 · COMMAND AND CONTROL
Asymmetric Cryptography
T1573.002Sub-technique of Encrypted ChannelLinux · macOS · Windows · Network Devices · ESXiattack.mitre.org
Adversaries may employ a known asymmetric encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol.
Detect it with
SSL/TLS inspection is one way of detecting command and control traffic within some encrypted communication channels.
Why it matters on shift
Asymmetric Cryptography is one of the concrete ways adversaries achieve command and control. Recognising it in telemetry lets you name the technique in your ticket and pivot to what came before and after.
What to look for next
After command and control, the next tactic is usually Exfiltration. Search your telemetry for the transition before closing the ticket.
Kill-chain context