CyberStack

MITRE ATT&CK / Techniques / T1573.001

Encrypted Channel: Symmetric Cryptography

ID
T1573.001
Tactics
TA0011 Command and Control
Sub-technique of
T1573 Encrypted Channel
Platforms
ESXi, Linux, macOS, Network Devices, Windows
Data sources
Module Load, Network Connection Creation, Process Creation, Application Log Content, Network Traffic Content, Network Traffic Flow
Source
attack.mitre.org
MITRE last modified
3 Sep 2026

Adversaries may employ a known symmetric encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Symmetric encryption algorithms use the same key for plaintext encryption and ciphertext decryption. Common symmetric encryption algorithms include AES, DES, 3DES, Blowfish, and RC4.[1][2]

Detection

Mitigations (1)

M1031 Network Intrusion Prevention

Network intrusion detection and prevention systems that use network signatures to identify traffic for specific adversary malware can be used to mitigate activity at the network level.

Groups (14)

Software (167)

Showing 60 of 167. Full list on attack.mitre.org.

References

  1. Destination Certification
  2. Symmetric vs Asymmetric Cryptography