Encrypted Channel
- ID
- T1573
- Tactics
- TA0011 Command and Control
- Platforms
- ESXi, Linux, macOS, Network Devices, Windows
- Data sources
- Network Connection Creation, Module Load, Application Log Content, Process Creation, Network Traffic Content, Network Traffic Flow
- Source
- attack.mitre.org
- MITRE last modified
- 4 Sep 2026
Adversaries may employ an encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Sub-techniques (2)
Detection
- DET0273 Detection Strategy for Encrypted Channel across OS Platforms
Data components: Network Connection Creation, Module Load, Application Log Content, Process Creation, Network Traffic Content, Network Traffic Flow
Mitigations (2)
- M1020 SSL/TLS Inspection
SSL/TLS inspection can be used to see the contents of encrypted sessions to look for network-based indicators of malware communication protocols.
- M1031 Network Intrusion Prevention
Network intrusion detection and prevention systems that use network signatures to identify traffic for specific adversary malware can be used to mitigate activity at the network level.