Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
| ID | Name | Description |
|---|---|---|
| G0016 | APT29 |
APT29 has used multiple layers of encryption within malware to protect C2 communication.[1] |
| S0631 | Chaes | |
| S0498 | Cryptoistic |
Cryptoistic can engage in encrypted communications with C2.[3] |
| S0032 | gh0st RAT |
gh0st RAT has encrypted TCP communications to evade detection.[4] |
| S0681 | Lizar |
Lizar can support encrypted communications between the client and server.[5][6] |
| S0198 | NETWIRE | |
| S0662 | RCSession |
RCSession can use an encrypted beacon to check in with C2.[8] |
| G0081 | Tropic Trooper |
Tropic Trooper has encrypted traffic with the C2 to prevent network detection.[9] |
| ID | Mitigation | Description |
|---|---|---|
| M1031 | Network Intrusion Prevention |
Network intrusion detection and prevention systems that use network signatures to identify traffic for specific adversary malware can be used to mitigate activity at the network level. |
| M1020 | SSL/TLS Inspection |
SSL/TLS inspection can be used to see the contents of encrypted sessions to look for network-based indicators of malware communication protocols. |
| ID | Data Source | Data Component |
|---|---|---|
| DS0029 | Network Traffic | Network Traffic Content |
SSL/TLS inspection is one way of detecting command and control traffic within some encrypted communication channels.[10] SSL/TLS inspection does come with certain risks that should be considered before implementing to avoid potential security issues such as incomplete certificate validation.[11]
In general, analyze network data for uncommon data flows (e.g., a client sending significantly more data than it receives from a server). Processes utilizing the network that do not normally have network communication or have never been seen before are suspicious. Analyze packet contents to detect communications that do not follow the expected protocol behavior for the port that is being used.[12]