CyberStack

MITRE ATT&CK / Techniques / T1573.002

Encrypted Channel: Asymmetric Cryptography

ID
T1573.002
Tactics
TA0011 Command and Control
Sub-technique of
T1573 Encrypted Channel
Platforms
ESXi, Linux, macOS, Network Devices, Windows
Data sources
Module Load, Network Connection Creation, Process Creation, Application Log Content, Network Traffic Content, Network Traffic Flow
Source
attack.mitre.org
MITRE last modified
12 Sep 2026

Adversaries may employ a known asymmetric encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Asymmetric cryptography, also known as public key cryptography, uses a keypair per party: one public that can be freely distributed, and one private. Due to how the keys are generated, the sender encrypts data with the receiver’s public key and the receiver decrypts the data with their private key. This ensures that only the intended recipient can read the encrypted data. Common public key encryption algorithms include RSA and ElGamal.

For efficiency, many protocols (including SSL/TLS) use symmetric cryptography once a connection is established, but use asymmetric cryptography to establish or transmit a key. As such, these protocols are classified as Asymmetric Cryptography.[1][2]

Detection

Mitigations (2)

M1020 SSL/TLS Inspection

SSL/TLS inspection can be used to see the contents of encrypted sessions to look for network-based indicators of malware communication protocols.

M1031 Network Intrusion Prevention

Network intrusion detection and prevention systems that use network signatures to identify traffic for specific adversary malware can be used to mitigate activity at the network level.

Groups (12)

Software (82)

Showing 60 of 82. Full list on attack.mitre.org.

References

  1. What is asymmetric encryption
  2. Symmetric vs Asymmetric Cryptography