detection.wiki

Weaken Encryption T1600

Tactic: Defense Impairment

Adversaries may compromise a network device’s encryption capability in order to bypass encryption that would otherwise protect data communications.

Authoring guide

These 3 rules share fields, values, and exclusions.

Fields filtered most (4 distinct)

These fields appear most often in rule filters.

FieldRulesHowSample values
EventID2eq 2CreateDistribution, CreateListener, ModifyListener, UpdateDistribution
action1eq 1ekm_unenrolled
target.resource.attribute.labels["requestParameters.distributionConfig.viewerCertificate.minimumProtocolVersion"]1eq 1SSLv3, TLSv1, TLSv1.1_2016
target.resource.attribute.labels["requestParameters.sslPolicy"]1eq 1ELBSecurityPolicy-2015-05, ELBSecurityPolicy-2016-08, ELBSecurityPolicy-FS-1-1-2019-08

Top indicator values (19 distinct)

These values appear most often in rule predicates.

FieldKindValueRules (here)Corpus reach
EventIDeq
CreateDistribution
1
EventIDeq
CreateListener
1
EventIDeq
ModifyListener
1
EventIDeq
UpdateDistribution
1
actioneq
ekm_unenrolled
1
target.resource.attribute.labels["requestParameters.distributionConfig.viewerCertificate.minimumProtocolVersion"]eq
SSLv3
1
target.resource.attribute.labels["requestParameters.distributionConfig.viewerCertificate.minimumProtocolVersion"]eq
TLSv1
1
target.resource.attribute.labels["requestParameters.distributionConfig.viewerCertificate.minimumProtocolVersion"]eq
TLSv1.1_2016
1
target.resource.attribute.labels["requestParameters.distributionConfig.viewerCertificate.minimumProtocolVersion"]eq
TLSv1_2016
1
target.resource.attribute.labels["requestParameters.sslPolicy"]eq
ELBSecurityPolicy-2015-05
1
target.resource.attribute.labels["requestParameters.sslPolicy"]eq
ELBSecurityPolicy-2016-08
1
target.resource.attribute.labels["requestParameters.sslPolicy"]eq
ELBSecurityPolicy-FS-1-1-2019-08
1
target.resource.attribute.labels["requestParameters.sslPolicy"]eq
ELBSecurityPolicy-FS-2018-06
1
target.resource.attribute.labels["requestParameters.sslPolicy"]eq
ELBSecurityPolicy-TLS-1-0-2015-04
1
target.resource.attribute.labels["requestParameters.sslPolicy"]eq
ELBSecurityPolicy-TLS-1-1-2017-01
1
target.resource.attribute.labels["requestParameters.sslPolicy"]eq
ELBSecurityPolicy-TLS13-1-0-2021-06
1
target.resource.attribute.labels["requestParameters.sslPolicy"]eq
ELBSecurityPolicy-TLS13-1-0-FIPS-2023-04
1
target.resource.attribute.labels["requestParameters.sslPolicy"]eq
ELBSecurityPolicy-TLS13-1-1-2021-06
1
target.resource.attribute.labels["requestParameters.sslPolicy"]eq
ELBSecurityPolicy-TLS13-1-1-FIPS-2023-04
1

Rules under this technique

These vendors publish rules tagged with this technique.

Platform (all)
Domain (all)

YARA-L 2 rules

Panther 1 rule