Encrypted Channel: Asymmetric Cryptography T1573.002

Tactic: Command & Control

Adversaries may employ a known asymmetric encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Asymmetric cryptography, also known as public key cryptography, uses a keypair per party: one public that can be freely distributed, and one private. Due to how the keys are generated, the sender encrypts data with the receiver’s public key and the receiver decrypts the data with their private key. This ensures that only the intended recipient can read the encrypted data. Common public key encryption algorithms include RSA and ElGamal.

Events covered

1 catalog event is tagged with this technique by at least one rule.

Authoring guide

Patterns shared across the 9 rules above: which fields they filter on, what specific values they look for, and what they exclude. The catalog normalizes field names across vendors so Sigma's Image, Elastic's process.name, and Splunk's process_name collapse into one row. Each rule contributes at most once per row.

Fields filtered most (21 distinct)

The fields most rules look at when detecting this technique. The How column shows the operators authors use (eq, wildcard, regex_match, match) and how often each appears. Sample values are concrete examples to start from, not an exhaustive list.

FieldRulesHowSample values
EventType6eq 5, in 1IntrusionEvent, *, ConnectionEvent, exec, exec_event
sourcetype5eq 5cisco:sfw:estreamer
p_enrichment.tor_exit_nodes2is_not_null 2
signature_id2in 262709, 62710, 62711, 62712, 64167
CommandLine1contains 1-encodedcommand
EVE_ThreatConfidencePct1ge 180
EfectiveCommand1regex_match 1regexEmpire
EventData1contains 1-encodedcommand, powershell.exe, powershell_ise.exe
EventID1eq 14688
Listingreason1is_not_null 1
SSL_CertFingerprint1eq 1*
category1in 1kube-audit, kube-audit-admin
event.type1eq 1start
gcp::service_name1eq 1k8s.io
host.os.type1eq 1

Top indicator values (67 distinct)

Specific (field, operator, value) combinations the rules check for, ranked by how many rules under this technique use each one. The Corpus reach column counts how many rules across the entire catalog (any technique) check the same combination. High numbers point to widely-used indicators that are likely noisy on their own; combine them with another condition for useful signal. Blank means the combination is specific to rules under this technique. Click a value to expand the rules under this technique that use it.

FieldKindValueRules (here)Corpus reach
sourcetypeeq
cisco:sfw:estreamer
532
EventTypeeq
IntrusionEvent
318
EventTypeeq
*
1
EventTypeeq
ConnectionEvent
19
CommandLinecontains
-encodedcommand
13
EVE_ThreatConfidencePctge
80
1
EfectiveCommandregex_match
regexEmpire
1
EventDatacontains
-encodedcommand
1
EventDatacontains
powershell.exe
1
EventDatacontains
powershell_ise.exe
1
EventDatacontains
pwsh.exe
1
EventIDeq
4688
1313
EventTypein
exec
1171
EventTypein
exec_event
1139
EventTypein
start
1134
SSL_CertFingerprinteq
*
1
categoryin
kube-audit
1
categoryin
kube-audit-admin
1
event.typeeq
start
1606
gcp::service_nameeq
k8s.io
1
operation.producereq
k8s.io
1
p_log_typeeq
Azure.MonitorActivity
1
p_log_typeeq
GCP.AuditLog
1
p_log_typein
Amazon.EKS.Audit
1
p_log_typein
Azure.MonitorActivity
1
p_log_typein
GCP.AuditLog
1
process.argseq
-port
1
process.argseq
s_client
12
process.argseq
s_server
1
process.argsin
/bin/bash
13

Exclusions (7 distinct)

Field/operator/value combinations excluded by rules under this technique (top-level not() clauses), sorted by how many rules exclude each. These are the false-positive paths the community has learned to filter out. A new rule that ignores the high-count entries here will likely fire on the same noisy paths. Click a value to expand the rules under this technique that exclude it.

FieldKindValueRules excluding
EventDatacontains
gc_service.exe
1
EventDatacontains
gc_worker.exe
1
ParentImagecontains
gc_service.exe
1
ParentImagecontains
gc_worker.exe
1
ParentImagein
/etc/zabbix/scripts/check_dane_tlsa.sh
1
ParentImagein
/opt/antidot-svc/nrpe/plugins/check_cert
1
ParentImagein
/pro/xymon/client/ext/awsxymoncheck.sh
1

Rules under this technique

Every rule in the catalog tagged with this technique, grouped by vendor. Click a rule title for its full predicates, exclusions, and indicators.

Platform (all)
Domain (all)

Elastic 1 rule

Splunk 5 rules

Kusto 1 rule

Panther 2 rules