sarahwei/cyber_MITRE_CTI_dataset_v15 huggingface dataset:
RemoteCMD can execute commands remotely by creating a new service on the remote system.
Technique: T1569.002 System Services: Service Execution, Tactic: TA0002 Execution
SLOTHFULMEDIA has the capability to start services.
Technique: T1569.002 System Services: Service Execution, Tactic: TA0002 Execution
Shamoon creates a new service named “ntssrv” to execute the payload. Shamoon can also spread via PsExec.
Technique: T1569.002 System Services: Service Execution, Tactic: TA0002 Execution
StrongPity can install a service to execute itself as a service.
Technique: T1569.002 System Services: Service Execution, Tactic: TA0002 Execution
SysUpdate can manage services and processes.
Technique: T1569.002 System Services: Service Execution, Tactic: TA0002 Execution
TinyTurla can install itself as a service on compromised machines.
Technique: T1569.002 System Services: Service Execution, Tactic: TA0002 Execution
WastedLocker can execute itself as a service.
Technique: T1569.002 System Services: Service Execution, Tactic: TA0002 Execution
WhisperGate can download and execute AdvancedRun.exe via `sc.exe`.
Technique: T1569.002 System Services: Service Execution, Tactic: TA0002 Execution
Winexe installs a service on the remote system, executes the command, then uninstalls the service.
Technique: T1569.002 System Services: Service Execution, Tactic: TA0002 Execution
Wingbird uses services.exe to register a new autostart service named "Audit Service" using a copy of the local lsass.exe file.
Technique: T1569.002 System Services: Service Execution, Tactic: TA0002 Execution
Winnti for Windows can run as a service using svchost.exe.
Technique: T1569.002 System Services: Service Execution, Tactic: TA0002 Execution
ZxShell can create a new service for execution.
Technique: T1569.002 System Services: Service Execution, Tactic: TA0002 Execution
gh0st RAT can execute its service if the Service key exists. If the key does not exist, gh0st RAT will create and run the service.
Technique: T1569.002 System Services: Service Execution, Tactic: TA0002 Execution
xCmd can be used to execute binaries on remote systems by creating and starting a service.
Technique: T1569.002 System Services: Service Execution, Tactic: TA0002 Execution
During the 2015 Ukraine Electric Power Attack, Sandworm Team moved their tools laterally within the corporate network and between the ICS and corporate network.
Technique: T1570 Lateral Tool Transfer, Tactic: TA0008 Lateral Movement
During the 2016 Ukraine Electric Power Attack, Sandworm Team used `move` to transfer files to a network share.
Technique: T1570 Lateral Tool Transfer, Tactic: TA0008 Lateral Movement
During the 2022 Ukraine Electric Power Attack, Sandworm Team used a Group Policy Object (GPO) to copy CaddyWiper's executable `msserver.exe` from a staging server to a local hard drive before deployment.
Technique: T1570 Lateral Tool Transfer, Tactic: TA0008 Lateral Movement
During C0015, the threat actors used WMI to load Cobalt Strike onto additional hosts within a compromised network.
Technique: T1570 Lateral Tool Transfer, Tactic: TA0008 Lateral Movement
During C0018, the threat actors transferred the SoftPerfect Network Scanner and other tools to machines in the network using AnyDesk and PDQ Deploy.
Technique: T1570 Lateral Tool Transfer, Tactic: TA0008 Lateral Movement
During Operation Wocao, threat actors used SMB to copy files to and from target systems.
Technique: T1570 Lateral Tool Transfer, Tactic: TA0008 Lateral Movement
APT32 has deployed tools after moving laterally using administrative accounts.
Technique: T1570 Lateral Tool Transfer, Tactic: TA0008 Lateral Movement
APT41 uses remote shares to move and remotely execute payloads during lateral movemement.
Technique: T1570 Lateral Tool Transfer, Tactic: TA0008 Lateral Movement
Aoqin Dragon has spread malware in target networks by copying modules to folders masquerading as removable devices.
Technique: T1570 Lateral Tool Transfer, Tactic: TA0008 Lateral Movement
Chimera has copied tools between compromised hosts using SMB.
Technique: T1570 Lateral Tool Transfer, Tactic: TA0008 Lateral Movement
FIN10 has deployed Meterpreter stagers and SplinterRAT instances in the victim network after moving laterally.
Technique: T1570 Lateral Tool Transfer, Tactic: TA0008 Lateral Movement
GALLIUM has used PsExec to move laterally between hosts in the target network.
Technique: T1570 Lateral Tool Transfer, Tactic: TA0008 Lateral Movement
Magic Hound has copied tools within a compromised network using RDP.
Technique: T1570 Lateral Tool Transfer, Tactic: TA0008 Lateral Movement
Sandworm Team has used `move` to transfer files to a network share and has copied payloads--such as Prestige ransomware--to an Active Directory Domain Controller and distributed via the Default Domain Group Policy Object.
Technique: T1570 Lateral Tool Transfer, Tactic: TA0008 Lateral Movement
Turla RPC backdoors can be used to transfer files to/from victim machines on the local network.
Technique: T1570 Lateral Tool Transfer, Tactic: TA0008 Lateral Movement
Volt Typhoon has copied web shells between servers in targeted environments.
Technique: T1570 Lateral Tool Transfer, Tactic: TA0008 Lateral Movement
Wizard Spider has used stolen credentials to copy tools into the `%TEMP%` directory of domain controllers.
Technique: T1570 Lateral Tool Transfer, Tactic: TA0008 Lateral Movement
BITSAdmin can be used to create BITS Jobs to upload and/or download files from SMB file servers.
Technique: T1570 Lateral Tool Transfer, Tactic: TA0008 Lateral Movement
BlackCat can replicate itself across connected servers via `psexec`.
Technique: T1570 Lateral Tool Transfer, Tactic: TA0008 Lateral Movement
DustySky searches for network drives and removable media and duplicates itself onto them.
Technique: T1570 Lateral Tool Transfer, Tactic: TA0008 Lateral Movement
Emotet has copied itself to remote systems using the `service.exe` filename.
Technique: T1570 Lateral Tool Transfer, Tactic: TA0008 Lateral Movement
Expand can be used to download or upload a file over a network share.
Technique: T1570 Lateral Tool Transfer, Tactic: TA0008 Lateral Movement
HermeticWizard can copy files to other machines on a compromised network.
Technique: T1570 Lateral Tool Transfer, Tactic: TA0008 Lateral Movement
LockerGoga has been observed moving around the victim network via SMB, indicating the actors behind this ransomware are manually copying files form computer to computer instead of self-propagating.
Technique: T1570 Lateral Tool Transfer, Tactic: TA0008 Lateral Movement
Lucifer can use certutil for propagation on Windows hosts within intranets.
Technique: T1570 Lateral Tool Transfer, Tactic: TA0008 Lateral Movement
Operators deploying Netwalker have used psexec to copy the Netwalker payload across accessible systems.
Technique: T1570 Lateral Tool Transfer, Tactic: TA0008 Lateral Movement
Olympic Destroyer attempts to copy itself to remote machines on the network.
Technique: T1570 Lateral Tool Transfer, Tactic: TA0008 Lateral Movement
PsExec can be used to download or upload a file over a network share.
Technique: T1570 Lateral Tool Transfer, Tactic: TA0008 Lateral Movement
Shamoon attempts to copy itself to remote machines on the network.
Technique: T1570 Lateral Tool Transfer, Tactic: TA0008 Lateral Movement
Stuxnet uses an RPC server that contains a file dropping routine and support for payload version updates for P2P communications within a victim network.
Technique: T1570 Lateral Tool Transfer, Tactic: TA0008 Lateral Movement
WannaCry attempts to copy itself to remote computers after gaining access via an SMB exploit.
Technique: T1570 Lateral Tool Transfer, Tactic: TA0008 Lateral Movement
cmd can be used to copy files to/from a remotely connected internal system.
Technique: T1570 Lateral Tool Transfer, Tactic: TA0008 Lateral Movement
esentutl can be used to copy files to/from a remote share.
Technique: T1570 Lateral Tool Transfer, Tactic: TA0008 Lateral Movement
ftp may be abused by adversaries to transfer tools or files between systems within a compromised environment.
Technique: T1570 Lateral Tool Transfer, Tactic: TA0008 Lateral Movement
During C0018, the threat actors opened a variety of ports, including ports 28035, 32467, 41578, and 46892, to establish RDP connections.
Technique: T1571 Non-Standard Port, Tactic: TA0011 Command and Control
During the C0032 campaign, TEMP.Veles used port-protocol mismatches on ports such as 443, 4444, 8531, and 50501 during C2.
Technique: T1571 Non-Standard Port, Tactic: TA0011 Command and Control
During Operation Wocao, the threat actors used uncommon high ports for its backdoor C2, including ports 25667 and 47000.
Technique: T1571 Non-Standard Port, Tactic: TA0011 Command and Control
APT-C-36 has used port 4050 for C2 communications.
Technique: T1571 Non-Standard Port, Tactic: TA0011 Command and Control
An APT32 backdoor can use HTTP over a non-standard TCP port (e.g 14146) which is specified in the backdoor configuration.
Technique: T1571 Non-Standard Port, Tactic: TA0011 Command and Control
APT33 has used HTTP over TCP ports 808 and 880 for command and control.
Technique: T1571 Non-Standard Port, Tactic: TA0011 Command and Control
DarkVishnya used ports 5190 and 7900 for shellcode listeners, and 4444, 4445, 31337 for shellcode C2.
Technique: T1571 Non-Standard Port, Tactic: TA0011 Command and Control
FIN7 has used port-protocol mismatches on ports such as 53, 80, 443, and 8080 during C2.
Technique: T1571 Non-Standard Port, Tactic: TA0011 Command and Control
Some Lazarus Group malware uses a list of ordered port numbers to choose a port for C2 traffic, creating port-protocol mismatches.
Technique: T1571 Non-Standard Port, Tactic: TA0011 Command and Control
Magic Hound malware has communicated with its C2 server over TCP ports 4443 and 10151 using HTTP.
Technique: T1571 Non-Standard Port, Tactic: TA0011 Command and Control
Rocke's miner connects to a C2 server using port 51640.
Technique: T1571 Non-Standard Port, Tactic: TA0011 Command and Control
Sandworm Team has used port 6789 to accept connections on the group's SSH server.
Technique: T1571 Non-Standard Port, Tactic: TA0011 Command and Control
Silence has used port 444 when sending data about the system from the client to the server.
Technique: T1571 Non-Standard Port, Tactic: TA0011 Command and Control
WIRTE has used HTTPS over ports 2083 and 2087 for C2.
Technique: T1571 Non-Standard Port, Tactic: TA0011 Command and Control
BADCALL communicates on ports 443 and 8000 with a FakeTLS method.
Technique: T1571 Non-Standard Port, Tactic: TA0011 Command and Control
Bankshot binds and listens on port 1058 for HTTP traffic while also utilizing a FakeTLS method.
Technique: T1571 Non-Standard Port, Tactic: TA0011 Command and Control
BendyBear has used a custom RC4 and XOR encrypted protocol over port 443 for C2.
Technique: T1571 Non-Standard Port, Tactic: TA0011 Command and Control
Cyclops Blink can use non-standard ports for C2 not typically associated with HTTP or HTTPS traffic.
Technique: T1571 Non-Standard Port, Tactic: TA0011 Command and Control
Derusbi has used unencrypted HTTP on port 443 for C2.
Technique: T1571 Non-Standard Port, Tactic: TA0011 Command and Control
Emotet has used HTTP over ports such as 20, 22, 443, 7080, and 50000, in addition to using ports commonly associated with HTTP/S.
Technique: T1571 Non-Standard Port, Tactic: TA0011 Command and Control
GoldenSpy has used HTTP over ports 9005 and 9006 for network traffic, 9002 for C2 requests, 33666 as a WebSocket, and 8090 to download files.
Technique: T1571 Non-Standard Port, Tactic: TA0011 Command and Control
GravityRAT has used HTTP over a non-standard port, such as TCP port 46769.
Technique: T1571 Non-Standard Port, Tactic: TA0011 Command and Control
HARDRAIN binds and listens on port 443 with a FakeTLS method.
Technique: T1571 Non-Standard Port, Tactic: TA0011 Command and Control
HOPLIGHT has connected outbound over TCP port 443 with a FakeTLS method.
Technique: T1571 Non-Standard Port, Tactic: TA0011 Command and Control
MacMa has used TCP port 5633 for C2 Communication.
Technique: T1571 Non-Standard Port, Tactic: TA0011 Command and Control
Metamorfo has communicated with hosts over raw TCP on port 9999.
Technique: T1571 Non-Standard Port, Tactic: TA0011 Command and Control
MoonWind communicates over ports 80, 443, 53, and 8080 via raw sockets instead of the protocols usually associated with the ports.
Technique: T1571 Non-Standard Port, Tactic: TA0011 Command and Control
OSX_OCEANLOTUS.D has used a custom binary protocol over TCP port 443 for C2.
Technique: T1571 Non-Standard Port, Tactic: TA0011 Command and Control
PingPull can use HTTPS over port 8080 for C2.
Technique: T1571 Non-Standard Port, Tactic: TA0011 Command and Control
PoetRAT used TLS to encrypt communications over port 143
Technique: T1571 Non-Standard Port, Tactic: TA0011 Command and Control
QuasarRAT can use port 4782 on the compromised host for TCP callbacks.
Technique: T1571 Non-Standard Port, Tactic: TA0011 Command and Control
RTM used Port 44443 for its VNC module.
Technique: T1571 Non-Standard Port, Tactic: TA0011 Command and Control
RedLeaves can use HTTP over non-standard ports, such as 995, for C2.
Technique: T1571 Non-Standard Port, Tactic: TA0011 Command and Control
RotaJakiro uses a custom binary protocol over TCP port 443.
Technique: T1571 Non-Standard Port, Tactic: TA0011 Command and Control
SUGARUSH has used port 4585 for a TCP connection to its C2.
Technique: T1571 Non-Standard Port, Tactic: TA0011 Command and Control
Sardonic has the ability to connect with actor-controlled C2 servers using a custom binary protocol over port 443.
Technique: T1571 Non-Standard Port, Tactic: TA0011 Command and Control
StrongPity has used HTTPS over port 1402 in C2 communication.
Technique: T1571 Non-Standard Port, Tactic: TA0011 Command and Control
TYPEFRAME has used ports 443, 8080, and 8443 with a FakeTLS method.
Technique: T1571 Non-Standard Port, Tactic: TA0011 Command and Control
Some TrickBot samples have used HTTP over ports 447 and 8082 for C2. Newer versions of TrickBot have been known to use a custom communication protocol which sends the data unencrypted over port 443.
Technique: T1571 Non-Standard Port, Tactic: TA0011 Command and Control
WellMail has been observed using TCP port 25, without using SMTP, to leverage an open port for secure command and control communications.
Technique: T1571 Non-Standard Port, Tactic: TA0011 Command and Control
ZxShell can use ports 1985 and 1986 in HTTP/S communication.
Technique: T1571 Non-Standard Port, Tactic: TA0011 Command and Control
njRAT has used port 1177 for HTTP C2 communications.
Technique: T1571 Non-Standard Port, Tactic: TA0011 Command and Control
During the 2022 Ukraine Electric Power Attack, Sandworm Team deployed the GOGETTER tunneler software to establish a “Yamux” TLS-based C2 channel with an external server(s).
Technique: T1572 Protocol Tunneling, Tactic: TA0011 Command and Control
During C0027, Scattered Spider used SSH tunneling in targeted environments.
Technique: T1572 Protocol Tunneling, Tactic: TA0011 Command and Control
During the C0032 campaign, TEMP.Veles used encrypted SSH-based PLINK tunnels to transfer tools and enable RDP connections throughout the environment.
Technique: T1572 Protocol Tunneling, Tactic: TA0011 Command and Control
During CostaRicto, the threat actors set up remote SSH tunneling into the victim's environment from a malicious domain.
Technique: T1572 Protocol Tunneling, Tactic: TA0011 Command and Control
During Cutting Edge, threat actors used Iodine to tunnel IPv4 traffic over DNS.
Technique: T1572 Protocol Tunneling, Tactic: TA0011 Command and Control
Chimera has encapsulated Cobalt Strike's C2 protocol in DNS and HTTPS.
Technique: T1572 Protocol Tunneling, Tactic: TA0011 Command and Control
Cinnamon Tempest has used the Iox and NPS proxy and tunneling tools in combination  create multiple connections through a single tunnel.
Technique: T1572 Protocol Tunneling, Tactic: TA0011 Command and Control
Cobalt Group has used the Plink utility to create SSH tunnels.
Technique: T1572 Protocol Tunneling, Tactic: TA0011 Command and Control
FIN13 has utilized web shells and Java tools for tunneling capabilities to and from compromised assets.
Technique: T1572 Protocol Tunneling, Tactic: TA0011 Command and Control
FIN6 used the Plink command-line utility to create SSH tunnels to C2 servers.
Technique: T1572 Protocol Tunneling, Tactic: TA0011 Command and Control
Fox Kitten has used protocol tunneling for communication and RDP activity on compromised hosts through the use of open source tools such as ngrok and custom tool SSHMinion.
Technique: T1572 Protocol Tunneling, Tactic: TA0011 Command and Control
Leviathan has used protocol tunneling to further conceal C2 communications and infrastructure.
Technique: T1572 Protocol Tunneling, Tactic: TA0011 Command and Control
Magic Hound has used Plink to tunnel RDP over SSH.
Technique: T1572 Protocol Tunneling, Tactic: TA0011 Command and Control
OilRig has used the Plink utility and other tools to create tunnels to C2 servers.
Technique: T1572 Protocol Tunneling, Tactic: TA0011 Command and Control
Brute Ratel C4 can use DNS over HTTPS for C2.
Technique: T1572 Protocol Tunneling, Tactic: TA0011 Command and Control
Cobalt Strike uses a custom command and control protocol that is encapsulated in HTTP, HTTPS, or DNS. In addition, it conducts peer-to-peer communication over Windows named pipes encapsulated in the SMB protocol. All protocols use their standard assigned ports.
Technique: T1572 Protocol Tunneling, Tactic: TA0011 Command and Control
Cyclops Blink can use DNS over HTTPS (DoH) to resolve C2 nodes.
Technique: T1572 Protocol Tunneling, Tactic: TA0011 Command and Control
Duqu uses a custom command and control protocol that communicates over commonly used ports, and is frequently encapsulated by application layer protocols.
Technique: T1572 Protocol Tunneling, Tactic: TA0011 Command and Control
FLIPSIDE uses RDP to tunnel traffic from a victim environment.
Technique: T1572 Protocol Tunneling, Tactic: TA0011 Command and Control
FunnyDream can connect to HTTP proxies via TCP to create a tunnel to C2.
Technique: T1572 Protocol Tunneling, Tactic: TA0011 Command and Control
Heyoka Backdoor can use spoofed DNS requests to create a bidirectional tunnel between a compromised host and its C2 servers.
Technique: T1572 Protocol Tunneling, Tactic: TA0011 Command and Control
Industroyer attempts to perform an HTTP CONNECT via an internal proxy to establish a tunnel.
Technique: T1572 Protocol Tunneling, Tactic: TA0011 Command and Control
Kevin can use a custom protocol tunneled through DNS or HTTP.
Technique: T1572 Protocol Tunneling, Tactic: TA0011 Command and Control
Milan can use a custom protocol tunneled through DNS or HTTP.
Technique: T1572 Protocol Tunneling, Tactic: TA0011 Command and Control
Mythic can use SOCKS proxies to tunnel traffic through another protocol.
Technique: T1572 Protocol Tunneling, Tactic: TA0011 Command and Control
The QakBot proxy module can encapsulate SOCKS5 protocol within its own proxy protocol.
Technique: T1572 Protocol Tunneling, Tactic: TA0011 Command and Control
Uroburos has the ability to communicate over custom communications methodologies that ride over common network protocols including raw TCP and UDP sockets, HTTP, SMTP, and DNS.
Technique: T1572 Protocol Tunneling, Tactic: TA0011 Command and Control
ngrok can tunnel RDP and other services securely over internet connections.
Technique: T1572 Protocol Tunneling, Tactic: TA0011 Command and Control
In the Triton Safety Instrumented System Attack, TEMP.Veles used cryptcat binaries to encrypt their traffic.
Technique: T1573 Encrypted Channel, Tactic: TA0011 Command and Control
APT29 has used multiple layers of encryption within malware to protect C2 communication.
Technique: T1573 Encrypted Channel, Tactic: TA0011 Command and Control
BITTER has encrypted their C2 communications.
Technique: T1573 Encrypted Channel, Tactic: TA0011 Command and Control
Magic Hound has used an encrypted http proxy in C2 communications.
Technique: T1573 Encrypted Channel, Tactic: TA0011 Command and Control
Tropic Trooper has encrypted traffic with the C2 to prevent network detection.
Technique: T1573 Encrypted Channel, Tactic: TA0011 Command and Control
Chaes has used encryption for its C2 channel.
Technique: T1573 Encrypted Channel, Tactic: TA0011 Command and Control
Cryptoistic can engage in encrypted communications with C2.
Technique: T1573 Encrypted Channel, Tactic: TA0011 Command and Control
Lizar can support encrypted communications between the client and server.
Technique: T1573 Encrypted Channel, Tactic: TA0011 Command and Control
MacMa has used TLS encryption to initialize a custom protocol for C2 communications.
Technique: T1573 Encrypted Channel, Tactic: TA0011 Command and Control
NETWIRE can encrypt C2 communications.
Technique: T1573 Encrypted Channel, Tactic: TA0011 Command and Control
PowGoop can receive encrypted commands from C2.
Technique: T1573 Encrypted Channel, Tactic: TA0011 Command and Control
PowerLess can use an encrypted channel for C2 communications.
Technique: T1573 Encrypted Channel, Tactic: TA0011 Command and Control
RCSession can use an encrypted beacon to check in with C2.
Technique: T1573 Encrypted Channel, Tactic: TA0011 Command and Control
gh0st RAT has encrypted TCP communications to evade detection.
Technique: T1573 Encrypted Channel, Tactic: TA0011 Command and Control
During Frankenstein, the threat actors communicated with C2 via an encrypted RC4 byte stream and AES-CBC.
Technique: T1573.001 Encrypted Channel: Symmetric Cryptography, Tactic: TA0011 Command and Control
During Operation Dream Job, Lazarus Group used an AES key to communicate with their C2 server.
Technique: T1573.001 Encrypted Channel: Symmetric Cryptography, Tactic: TA0011 Command and Control
APT28 installed a Delphi backdoor that used a custom algorithm for C2 communications.
Technique: T1573.001 Encrypted Channel: Symmetric Cryptography, Tactic: TA0011 Command and Control
APT33 has used AES for encryption of command and control traffic.
Technique: T1573.001 Encrypted Channel: Symmetric Cryptography, Tactic: TA0011 Command and Control
BRONZE BUTLER has used RC4 encryption (for Datper malware) and AES (for xxmm malware) to obfuscate HTTP traffic. BRONZE BUTLER has also used a tool called RarStar that encodes data with a custom XOR algorithm when posting it to a C2 server.
Technique: T1573.001 Encrypted Channel: Symmetric Cryptography, Tactic: TA0011 Command and Control
Darkhotel has used AES-256 and 3DES for C2 communications.
Technique: T1573.001 Encrypted Channel: Symmetric Cryptography, Tactic: TA0011 Command and Control
Higaisa used AES-128 to encrypt C2 traffic.
Technique: T1573.001 Encrypted Channel: Symmetric Cryptography, Tactic: TA0011 Command and Control
Inception has encrypted network communications with AES.
Technique: T1573.001 Encrypted Channel: Symmetric Cryptography, Tactic: TA0011 Command and Control
Several Lazarus Group malware families encrypt C2 traffic using custom code that uses XOR with an ADD operation and XOR with a SUB operation. Another Lazarus Group malware sample XORs C2 traffic. Other Lazarus Group malware uses Caracachs encryption to encrypt C2 payloads. Lazarus Group has also used AES to encrypt C2 traffic.
Technique: T1573.001 Encrypted Channel: Symmetric Cryptography, Tactic: TA0011 Command and Control
MuddyWater has used AES to encrypt C2 responses.
Technique: T1573.001 Encrypted Channel: Symmetric Cryptography, Tactic: TA0011 Command and Control
Mustang Panda has encrypted C2 communications with RC4.
Technique: T1573.001 Encrypted Channel: Symmetric Cryptography, Tactic: TA0011 Command and Control
Stealth Falcon malware encrypts C2 traffic using RC4 with a hard-coded key.
Technique: T1573.001 Encrypted Channel: Symmetric Cryptography, Tactic: TA0011 Command and Control
Volt Typhoon has used a version of the Awen web shell that employed AES encryption and decryption for C2 communications.
Technique: T1573.001 Encrypted Channel: Symmetric Cryptography, Tactic: TA0011 Command and Control
ZIRCONIUM has used AES encrypted communications in C2.
Technique: T1573.001 Encrypted Channel: Symmetric Cryptography, Tactic: TA0011 Command and Control
3PARA RAT command and control commands are encrypted within the HTTP C2 channel using the DES algorithm in CBC mode with a key derived from the MD5 hash of the string HYF54&%9&jkMCXuiS. 3PARA RAT will use an 8-byte XOR key derived from the string HYF54&%9&jkMCXuiS if the DES decoding fails
Technique: T1573.001 Encrypted Channel: Symmetric Cryptography, Tactic: TA0011 Command and Control
4H RAT obfuscates C2 communication using a 1-byte XOR with the key 0xBE.
Technique: T1573.001 Encrypted Channel: Symmetric Cryptography, Tactic: TA0011 Command and Control
A variant of ADVSTORESHELL encrypts some C2 with 3DES.
Technique: T1573.001 Encrypted Channel: Symmetric Cryptography, Tactic: TA0011 Command and Control
Attor has encrypted data symmetrically using a randomly generated Blowfish (OFB) key which is encrypted with a public RSA key.
Technique: T1573.001 Encrypted Channel: Symmetric Cryptography, Tactic: TA0011 Command and Control
Azorult can encrypt C2 traffic using XOR.
Technique: T1573.001 Encrypted Channel: Symmetric Cryptography, Tactic: TA0011 Command and Control
BADCALL encrypts C2 traffic using an XOR/ADD cipher.
Technique: T1573.001 Encrypted Channel: Symmetric Cryptography, Tactic: TA0011 Command and Control
BADNEWS encrypts C2 data with a ROR by 3 and an XOR by 0x23.
Technique: T1573.001 Encrypted Channel: Symmetric Cryptography, Tactic: TA0011 Command and Control
BBSRAT uses a custom encryption algorithm on data sent back to the C2 server over HTTP.
Technique: T1573.001 Encrypted Channel: Symmetric Cryptography, Tactic: TA0011 Command and Control
BLINDINGCAN has encrypted its C2 traffic with RC4.
Technique: T1573.001 Encrypted Channel: Symmetric Cryptography, Tactic: TA0011 Command and Control
Bandook has used AES encryption for C2 communication.
Technique: T1573.001 Encrypted Channel: Symmetric Cryptography, Tactic: TA0011 Command and Control
Bazar can send C2 communications with XOR encryption.
Technique: T1573.001 Encrypted Channel: Symmetric Cryptography, Tactic: TA0011 Command and Control
BendyBear communicates to a C2 server over port 443 using modified RC4 and XOR-encrypted chunks.
Technique: T1573.001 Encrypted Channel: Symmetric Cryptography, Tactic: TA0011 Command and Control
Bisonal variants reported on in 2014 and 2015 used a simple XOR cipher for C2. Some Bisonal samples encrypt C2 communications with RC4.
Technique: T1573.001 Encrypted Channel: Symmetric Cryptography, Tactic: TA0011 Command and Control
Bonadan can XOR-encrypt C2 communications.
Technique: T1573.001 Encrypted Channel: Symmetric Cryptography, Tactic: TA0011 Command and Control
Bumblebee can encrypt C2 requests and responses with RC4
Technique: T1573.001 Encrypted Channel: Symmetric Cryptography, Tactic: TA0011 Command and Control
CHOPSTICK encrypts C2 communications with RC4.
Technique: T1573.001 Encrypted Channel: Symmetric Cryptography, Tactic: TA0011 Command and Control
CORESHELL C2 messages are encrypted with custom stream ciphers using six-byte or eight-byte keys.
Technique: T1573.001 Encrypted Channel: Symmetric Cryptography, Tactic: TA0011 Command and Control
CallMe uses AES to encrypt C2 traffic.
Technique: T1573.001 Encrypted Channel: Symmetric Cryptography, Tactic: TA0011 Command and Control
Carbanak encrypts the message body of HTTP traffic with RC2 (in CBC mode). Carbanak also uses XOR with random keys for its communications.
Technique: T1573.001 Encrypted Channel: Symmetric Cryptography, Tactic: TA0011 Command and Control
Cardinal RAT uses a secret key with a series of XOR and addition operations to encrypt C2 traffic.
Technique: T1573.001 Encrypted Channel: Symmetric Cryptography, Tactic: TA0011 Command and Control
ChChes can encrypt C2 traffic with AES or RC4.
Technique: T1573.001 Encrypted Channel: Symmetric Cryptography, Tactic: TA0011 Command and Control
Chaos provides a reverse shell connection on 8338/TCP, encrypted via AES.
Technique: T1573.001 Encrypted Channel: Symmetric Cryptography, Tactic: TA0011 Command and Control
CharmPower can send additional modules over C2 encrypted with a simple substitution cipher.
Technique: T1573.001 Encrypted Channel: Symmetric Cryptography, Tactic: TA0011 Command and Control
Cobalt Strike has the ability to use AES-256 symmetric encryption in CBC mode with HMAC-SHA-256 to encrypt task commands and XOR to encrypt shell code and configuration data.
Technique: T1573.001 Encrypted Channel: Symmetric Cryptography, Tactic: TA0011 Command and Control
Comnie encrypts command and control communications with RC4.
Technique: T1573.001 Encrypted Channel: Symmetric Cryptography, Tactic: TA0011 Command and Control
CosmicDuke contains a custom version of the RC4 algorithm that includes a programming error.
Technique: T1573.001 Encrypted Channel: Symmetric Cryptography, Tactic: TA0011 Command and Control
Daserf uses RC4 encryption to obfuscate HTTP traffic.
Technique: T1573.001 Encrypted Channel: Symmetric Cryptography, Tactic: TA0011 Command and Control
Derusbi obfuscates C2 traffic with variable 4-byte XOR keys.
Technique: T1573.001 Encrypted Channel: Symmetric Cryptography, Tactic: TA0011 Command and Control
Dipsind encrypts C2 data with AES256 in ECB mode.
Technique: T1573.001 Encrypted Channel: Symmetric Cryptography, Tactic: TA0011 Command and Control
Downdelph uses RC4 to encrypt C2 responses.
Technique: T1573.001 Encrypted Channel: Symmetric Cryptography, Tactic: TA0011 Command and Control
Dridex has encrypted traffic with RC4.
Technique: T1573.001 Encrypted Channel: Symmetric Cryptography, Tactic: TA0011 Command and Control
The Duqu command and control protocol's data stream can be encrypted with AES-CBC.
Technique: T1573.001 Encrypted Channel: Symmetric Cryptography, Tactic: TA0011 Command and Control
Ebury has encrypted C2 traffic using the client IP address, then encoded it as a hexadecimal string.
Technique: T1573.001 Encrypted Channel: Symmetric Cryptography, Tactic: TA0011 Command and Control
Elise encrypts exfiltrated data with RC4.
Technique: T1573.001 Encrypted Channel: Symmetric Cryptography, Tactic: TA0011 Command and Control
The C2 server response to a beacon sent by a variant of Emissary contains a 36-character GUID value that is used as an encryption key for subsequent network communications. Some variants of Emissary use various XOR operations to encrypt C2 data.
Technique: T1573.001 Encrypted Channel: Symmetric Cryptography, Tactic: TA0011 Command and Control
Epic encrypts commands from the C2 server using a hardcoded key.
Technique: T1573.001 Encrypted Channel: Symmetric Cryptography, Tactic: TA0011 Command and Control
Explosive has encrypted communications with the RC4 method.
Technique: T1573.001 Encrypted Channel: Symmetric Cryptography, Tactic: TA0011 Command and Control
FALLCHILL encrypts C2 data with RC4 encryption.
Technique: T1573.001 Encrypted Channel: Symmetric Cryptography, Tactic: TA0011 Command and Control
The original variant of FakeM encrypts C2 traffic using a custom encryption cipher that uses an XOR key of “YHCRA” and bit rotation between each XOR operation. Some variants of FakeM use RC4 to encrypt C2 traffic.
Technique: T1573.001 Encrypted Channel: Symmetric Cryptography, Tactic: TA0011 Command and Control
FatDuke can AES encrypt C2 communications.
Technique: T1573.001 Encrypted Channel: Symmetric Cryptography, Tactic: TA0011 Command and Control
Some Felismus samples use a custom encryption method for C2 traffic that utilizes AES and multiple keys.
Technique: T1573.001 Encrypted Channel: Symmetric Cryptography, Tactic: TA0011 Command and Control
FlawedAmmyy has used SEAL encryption during the initial C2 handshake.
Technique: T1573.001 Encrypted Channel: Symmetric Cryptography, Tactic: TA0011 Command and Control
FoggyWeb has used a dynamic XOR key and custom XOR methodology for C2 communications.
Technique: T1573.001 Encrypted Channel: Symmetric Cryptography, Tactic: TA0011 Command and Control
Gazer uses custom encryption for C2 that uses 3DES.
Technique: T1573.001 Encrypted Channel: Symmetric Cryptography, Tactic: TA0011 Command and Control
GreyEnergy encrypts communications using AES256.
Technique: T1573.001 Encrypted Channel: Symmetric Cryptography, Tactic: TA0011 Command and Control
GrimAgent can use an AES key to encrypt C2 communications.
Technique: T1573.001 Encrypted Channel: Symmetric Cryptography, Tactic: TA0011 Command and Control
H1N1 encrypts C2 traffic using an RC4 key.
Technique: T1573.001 Encrypted Channel: Symmetric Cryptography, Tactic: TA0011 Command and Control
Before being appended to image files, HAMMERTOSS commands are encrypted with a key composed of both a hard-coded value and a string contained on that day's tweet. To decrypt the commands, an investigator would need access to the intended malware sample, the day's tweet, and the image file containing the command.
Technique: T1573.001 Encrypted Channel: Symmetric Cryptography, Tactic: TA0011 Command and Control
Helminth encrypts data sent to its C2 server over HTTP with RC4.
Technique: T1573.001 Encrypted Channel: Symmetric Cryptography, Tactic: TA0011 Command and Control
Hi-Zor encrypts C2 traffic with a double XOR using two distinct single-byte keys.
Technique: T1573.001 Encrypted Channel: Symmetric Cryptography, Tactic: TA0011 Command and Control
HiddenWasp uses an RC4-like algorithm with an already computed PRGA generated key-stream for network communication.
Technique: T1573.001 Encrypted Channel: Symmetric Cryptography, Tactic: TA0011 Command and Control
Hikit performs XOR encryption.
Technique: T1573.001 Encrypted Channel: Symmetric Cryptography, Tactic: TA0011 Command and Control
HotCroissant has compressed network communications and encrypted them with a custom stream cipher.
Technique: T1573.001 Encrypted Channel: Symmetric Cryptography, Tactic: TA0011 Command and Control
Hydraq C2 traffic is encrypted using bitwise NOT and XOR operations.
Technique: T1573.001 Encrypted Channel: Symmetric Cryptography, Tactic: TA0011 Command and Control
HyperStack has used RSA encryption for C2 communications.
Technique: T1573.001 Encrypted Channel: Symmetric Cryptography, Tactic: TA0011 Command and Control
The IceApple Result Retriever module can AES encrypt C2 responses.
Technique: T1573.001 Encrypted Channel: Symmetric Cryptography, Tactic: TA0011 Command and Control
InvisiMole uses variations of a simple XOR encryption routine for C&C communications.
Technique: T1573.001 Encrypted Channel: Symmetric Cryptography, Tactic: TA0011 Command and Control
KEYMARBLE uses a customized XOR algorithm to encrypt C2 communications.
Technique: T1573.001 Encrypted Channel: Symmetric Cryptography, Tactic: TA0011 Command and Control
KONNI has used AES to encrypt C2 traffic.
Technique: T1573.001 Encrypted Channel: Symmetric Cryptography, Tactic: TA0011 Command and Control
Kobalos's post-authentication communication channel uses a 32-byte-long password with RC4 for inbound and outbound traffic.
Technique: T1573.001 Encrypted Channel: Symmetric Cryptography, Tactic: TA0011 Command and Control
The Komplex C2 channel uses an 11-byte XOR algorithm to hide data.
Technique: T1573.001 Encrypted Channel: Symmetric Cryptography, Tactic: TA0011 Command and Control
LIGHTWIRE can RC4 encrypt C2 commands.
Technique: T1573.001 Encrypted Channel: Symmetric Cryptography, Tactic: TA0011 Command and Control
LightNeuron uses AES to encrypt C2 traffic.
Technique: T1573.001 Encrypted Channel: Symmetric Cryptography, Tactic: TA0011 Command and Control
LookBack uses a modified version of RC4 for data transfer.
Technique: T1573.001 Encrypted Channel: Symmetric Cryptography, Tactic: TA0011 Command and Control
Lucifer can perform a decremental-xor encryption on the initial C2 request before sending it over the wire.
Technique: T1573.001 Encrypted Channel: Symmetric Cryptography, Tactic: TA0011 Command and Control
Lurid performs XOR encryption.
Technique: T1573.001 Encrypted Channel: Symmetric Cryptography, Tactic: TA0011 Command and Control
Machete has used AES to exfiltrate documents.
Technique: T1573.001 Encrypted Channel: Symmetric Cryptography, Tactic: TA0011 Command and Control
Mafalda can encrypt its C2 traffic with RC4.
Technique: T1573.001 Encrypted Channel: Symmetric Cryptography, Tactic: TA0011 Command and Control
Metamorfo has encrypted C2 commands with AES-256.
Technique: T1573.001 Encrypted Channel: Symmetric Cryptography, Tactic: TA0011 Command and Control
Mongall has the ability to RC4 encrypt C2 communications.
Technique: T1573.001 Encrypted Channel: Symmetric Cryptography, Tactic: TA0011 Command and Control
MoonWind encrypts C2 traffic using RC4 with a static key.
Technique: T1573.001 Encrypted Channel: Symmetric Cryptography, Tactic: TA0011 Command and Control
More_eggs has used an RC4-based encryption method for its C2 communications.
Technique: T1573.001 Encrypted Channel: Symmetric Cryptography, Tactic: TA0011 Command and Control
Mosquito uses a custom encryption algorithm, which consists of XOR and a stream that is similar to the Blum Blum Shub algorithm.
Technique: T1573.001 Encrypted Channel: Symmetric Cryptography, Tactic: TA0011 Command and Control
NDiskMonitor uses AES to encrypt certain information sent over its C2 channel.
Technique: T1573.001 Encrypted Channel: Symmetric Cryptography, Tactic: TA0011 Command and Control
NETEAGLE will decrypt resources it downloads with HTTP requests by using RC4 with the key "ScoutEagle."
Technique: T1573.001 Encrypted Channel: Symmetric Cryptography, Tactic: TA0011 Command and Control
NETWIRE can use AES encryption for C2 data transferred.
Technique: T1573.001 Encrypted Channel: Symmetric Cryptography, Tactic: TA0011 Command and Control
NGLite will use an AES encrypted channel for command and control purposes, in one case using the key `WHATswrongwithUu`.
Technique: T1573.001 Encrypted Channel: Symmetric Cryptography, Tactic: TA0011 Command and Control
NanoCore uses DES to encrypt the C2 traffic.
Technique: T1573.001 Encrypted Channel: Symmetric Cryptography, Tactic: TA0011 Command and Control
Nebulae can use RC4 and XOR to encrypt C2 communications.
Technique: T1573.001 Encrypted Channel: Symmetric Cryptography, Tactic: TA0011 Command and Control
Ninja can XOR and AES encrypt C2 messages.
Technique: T1573.001 Encrypted Channel: Symmetric Cryptography, Tactic: TA0011 Command and Control
OSX_OCEANLOTUS.D encrypts data sent back to the C2 using AES in CBC mode with a null initialization vector (IV) and a key sent from the server that is padded to 32 bytes.
Technique: T1573.001 Encrypted Channel: Symmetric Cryptography, Tactic: TA0011 Command and Control
Okrum uses AES to encrypt network traffic. The key can be hardcoded or negotiated with the C2 server in the registration phase.
Technique: T1573.001 Encrypted Channel: Symmetric Cryptography, Tactic: TA0011 Command and Control
PLAINTEE encodes C2 beacons using XOR.
Technique: T1573.001 Encrypted Channel: Symmetric Cryptography, Tactic: TA0011 Command and Control
PLEAD has used RC4 encryption to download modules.
Technique: T1573.001 Encrypted Channel: Symmetric Cryptography, Tactic: TA0011 Command and Control
POWERTON has used AES for encrypting C2 traffic.
Technique: T1573.001 Encrypted Channel: Symmetric Cryptography, Tactic: TA0011 Command and Control
Pandora has the ability to encrypt communications with D3DES.
Technique: T1573.001 Encrypted Channel: Symmetric Cryptography, Tactic: TA0011 Command and Control
PingPull can use AES, in cipher block chaining (CBC) mode padded with PKCS5, to encrypt C2 server communications.
Technique: T1573.001 Encrypted Channel: Symmetric Cryptography, Tactic: TA0011 Command and Control
PipeMon communications are RC4 encrypted.
Technique: T1573.001 Encrypted Channel: Symmetric Cryptography, Tactic: TA0011 Command and Control
PlugX can use RC4 encryption in C2 communications.
Technique: T1573.001 Encrypted Channel: Symmetric Cryptography, Tactic: TA0011 Command and Control
PoisonIvy uses the Camellia cipher to encrypt communications.
Technique: T1573.001 Encrypted Channel: Symmetric Cryptography, Tactic: TA0011 Command and Control
Prikormka encrypts some C2 traffic with the Blowfish cipher.
Technique: T1573.001 Encrypted Channel: Symmetric Cryptography, Tactic: TA0011 Command and Control
QUIETCANARY can RC4 encrypt C2 communications.
Technique: T1573.001 Encrypted Channel: Symmetric Cryptography, Tactic: TA0011 Command and Control
QakBot can RC4 encrypt strings in C2 communication.
Technique: T1573.001 Encrypted Channel: Symmetric Cryptography, Tactic: TA0011 Command and Control
QuasarRAT uses AES with a hardcoded pre-shared key to encrypt network communication.
Technique: T1573.001 Encrypted Channel: Symmetric Cryptography, Tactic: TA0011 Command and Control
RDAT has used AES ciphertext to encode C2 communications.
Technique: T1573.001 Encrypted Channel: Symmetric Cryptography, Tactic: TA0011 Command and Control
APT12 has used the RIPTIDE RAT, which communicates over HTTP with a payload encrypted with RC4.
Technique: T1573.001 Encrypted Channel: Symmetric Cryptography, Tactic: TA0011 Command and Control
RTM encrypts C2 traffic with a custom RC4 variant.
Technique: T1573.001 Encrypted Channel: Symmetric Cryptography, Tactic: TA0011 Command and Control
RainyDay can use RC4 to encrypt C2 communications.
Technique: T1573.001 Encrypted Channel: Symmetric Cryptography, Tactic: TA0011 Command and Control
RedLeaves has encrypted C2 traffic with RC4, previously using keys of 88888888 and babybear.
Technique: T1573.001 Encrypted Channel: Symmetric Cryptography, Tactic: TA0011 Command and Control
Rifdoor has encrypted command and control (C2) communications with a stream cipher.
Technique: T1573.001 Encrypted Channel: Symmetric Cryptography, Tactic: TA0011 Command and Control
RotaJakiro encrypts C2 communication using a combination of AES, XOR, ROTATE encryption, and ZLIB compression.
Technique: T1573.001 Encrypted Channel: Symmetric Cryptography, Tactic: TA0011 Command and Control
SLIGHTPULSE can RC4 encrypt all incoming and outgoing C2 messages.
Technique: T1573.001 Encrypted Channel: Symmetric Cryptography, Tactic: TA0011 Command and Control
SMOKEDHAM has encrypted its C2 traffic with RC4.
Technique: T1573.001 Encrypted Channel: Symmetric Cryptography, Tactic: TA0011 Command and Control
SNUGRIDE encrypts C2 traffic using AES with a static key.
Technique: T1573.001 Encrypted Channel: Symmetric Cryptography, Tactic: TA0011 Command and Control
SUNBURST encrypted C2 traffic using a single-byte-XOR cipher.
Technique: T1573.001 Encrypted Channel: Symmetric Cryptography, Tactic: TA0011 Command and Control
Sakula encodes C2 traffic with single-byte XOR keys.
Technique: T1573.001 Encrypted Channel: Symmetric Cryptography, Tactic: TA0011 Command and Control
Samurai can encrypt C2 communications with AES.
Technique: T1573.001 Encrypted Channel: Symmetric Cryptography, Tactic: TA0011 Command and Control
Sardonic has the ability to use an RC4 key to encrypt communications to and from actor-controlled C2 servers.
Technique: T1573.001 Encrypted Channel: Symmetric Cryptography, Tactic: TA0011 Command and Control
SeaDuke C2 traffic has been encrypted with RC4 and AES.
Technique: T1573.001 Encrypted Channel: Symmetric Cryptography, Tactic: TA0011 Command and Control
SideTwist can encrypt C2 communications with a randomly generated key.
Technique: T1573.001 Encrypted Channel: Symmetric Cryptography, Tactic: TA0011 Command and Control
Sliver can use AES-GCM-256 to encrypt a session key for C2 message exchange.
Technique: T1573.001 Encrypted Channel: Symmetric Cryptography, Tactic: TA0011 Command and Control
SodaMaster can use RC4 to encrypt C2 communications.
Technique: T1573.001 Encrypted Channel: Symmetric Cryptography, Tactic: TA0011 Command and Control
SombRAT has encrypted its C2 communications with AES.
Technique: T1573.001 Encrypted Channel: Symmetric Cryptography, Tactic: TA0011 Command and Control
StrifeWater can encrypt C2 traffic using XOR with a hard coded key.
Technique: T1573.001 Encrypted Channel: Symmetric Cryptography, Tactic: TA0011 Command and Control
Stuxnet encodes the payload of system information sent to the command and control servers using a one byte 0xFF XOR key. Stuxnet also uses a 31-byte long static byte string to XOR data sent to command and control servers. The servers use a different static key to encrypt replies to the implant.
Technique: T1573.001 Encrypted Channel: Symmetric Cryptography, Tactic: TA0011 Command and Control
Sys10 uses an XOR 0x1 loop to encrypt its C2 domain.
Technique: T1573.001 Encrypted Channel: Symmetric Cryptography, Tactic: TA0011 Command and Control
SysUpdate has used DES to encrypt all C2 communications.
Technique: T1573.001 Encrypted Channel: Symmetric Cryptography, Tactic: TA0011 Command and Control
TAINTEDSCRIBE uses a Linear Feedback Shift Register (LFSR) algorithm for network encryption.
Technique: T1573.001 Encrypted Channel: Symmetric Cryptography, Tactic: TA0011 Command and Control
TSCookie has encrypted network communications with RC4.
Technique: T1573.001 Encrypted Channel: Symmetric Cryptography, Tactic: TA0011 Command and Control
Taidoor uses RC4 to encrypt the message body of HTTP content.
Technique: T1573.001 Encrypted Channel: Symmetric Cryptography, Tactic: TA0011 Command and Control
Torisma has encrypted its C2 communications using XOR and VEST-32.
Technique: T1573.001 Encrypted Channel: Symmetric Cryptography, Tactic: TA0011 Command and Control
TrickBot uses a custom crypter leveraging Microsoft’s CryptoAPI to encrypt C2 traffic.Newer versions of TrickBot have been known to use `bcrypt` to encrypt and digitally sign responses to their C2 server.
Technique: T1573.001 Encrypted Channel: Symmetric Cryptography, Tactic: TA0011 Command and Control
UBoatRAT encrypts instructions in its C2 network payloads using a simple XOR cipher.
Technique: T1573.001 Encrypted Channel: Symmetric Cryptography, Tactic: TA0011 Command and Control
Some versions of UPPERCUT have used the hard-coded string “this is the encrypt key” for Blowfish encryption when communicating with a C2. Later versions have hard-coded keys uniquely for each C2 address.
Technique: T1573.001 Encrypted Channel: Symmetric Cryptography, Tactic: TA0011 Command and Control
Uroburos can encrypt the data beneath its http2 or tcp encryption at the session layer with CAST-128, using a different key for incoming and outgoing data.
Technique: T1573.001 Encrypted Channel: Symmetric Cryptography, Tactic: TA0011 Command and Control
Volgmer uses a simple XOR cipher to encrypt traffic and files.
Technique: T1573.001 Encrypted Channel: Symmetric Cryptography, Tactic: TA0011 Command and Control
WIREFIRE can AES encrypt process output sent from compromised devices to C2.
Technique: T1573.001 Encrypted Channel: Symmetric Cryptography, Tactic: TA0011 Command and Control
WarzoneRAT can encrypt its C2 with RC4 with the password `warzone160\x00`.
Technique: T1573.001 Encrypted Channel: Symmetric Cryptography, Tactic: TA0011 Command and Control
WellMess can encrypt HTTP POST data using RC6 and a dynamically generated AES key encrypted with a hard coded RSA public key.
Technique: T1573.001 Encrypted Channel: Symmetric Cryptography, Tactic: TA0011 Command and Control
Winnti for Linux has used a custom TCP protocol with four-byte XOR for command and control (C2).
Technique: T1573.001 Encrypted Channel: Symmetric Cryptography, Tactic: TA0011 Command and Control
Winnti for Windows can XOR encrypt C2 traffic.
Technique: T1573.001 Encrypted Channel: Symmetric Cryptography, Tactic: TA0011 Command and Control
Woody RAT can use AES-CBC to encrypt data sent to its C2 server.
Technique: T1573.001 Encrypted Channel: Symmetric Cryptography, Tactic: TA0011 Command and Control
XCSSET uses RC4 encryption over TCP to communicate with its C2 server.
Technique: T1573.001 Encrypted Channel: Symmetric Cryptography, Tactic: TA0011 Command and Control
ZIPLINE can use AES-128-CBC to encrypt data for both upload and download.
Technique: T1573.001 Encrypted Channel: Symmetric Cryptography, Tactic: TA0011 Command and Control
ZeroT has used RC4 to encrypt C2 traffic.
Technique: T1573.001 Encrypted Channel: Symmetric Cryptography, Tactic: TA0011 Command and Control
down_new has the ability to AES encrypt C2 communications.
Technique: T1573.001 Encrypted Channel: Symmetric Cryptography, Tactic: TA0011 Command and Control
gh0st RAT uses RC4 and XOR to encrypt C2 traffic.
Technique: T1573.001 Encrypted Channel: Symmetric Cryptography, Tactic: TA0011 Command and Control