Applied Cybernetics Group
T1573.001 — Symmetric Cryptography
coverage gap
- Technique
T1573.001- Tactics
- Command and Control
- MISP citations
- 0
- KEV CVEs mapped
- 3
- Community rules
- 0
- thrunt rules
- 0
- Upstream
- https://attack.mitre.org/techniques/T1573/001
MITRE description
Adversaries may employ a known symmetric encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Symmetric encryption algorithms use the same key for plaintext encryption and ciphertext decryption. Common symmetric encryption algorithms include AES, DES, 3DES, Blowfish, and RC4.
KEV CVEs mapped to this technique
Per MITRE CTID's hand-curated KEV→ATT&CK mappings — these are the actively-exploited vulnerabilities behind this technique's KEV signal.
Detection coverage
cipher choice is a payload-content property with no single-event field in any standard Sigma logsource; writable rules degenerate to family IOCs or aggregation analytics
T1573.001 carries live KEV signal — CVE-2021-40539 and CVE-2021-44077 (Zoho ManageEngine) intrusions dropped implants with symmetric-encrypted C2, and CVE-2021-40449 chains delivered the MysterySnail RAT — but the technique itself is a property of payload content: which cipher the implant applies to its channel. No standard Sigma logsource exposes that as a matchable field. Endpoint network telemetry (Sysmon EID 3 and analogs) records endpoints and ports, not content; Zeek ssl.log exposes negotiated TLS ciphers, but protocol-negotiated encryption is T1573.002 — the .001 tradecraft is pre-shared-key RC4/AES applied inside otherwise ordinary-looking TCP or HTTP, indistinguishable per-event from benign binary traffic. Every honest single-event detection in this neighborhood degenerates into a malware-family IOC rule, which is exactly what the existing parent-tagged community rules (Pikabot C2 ports, Kalambur TOR proxy execution) already are; the generic alternative — entropy or beaconing analytics — requires aggregation that base Sigma cannot express. We hold rather than publish a rule that would either duplicate family IOCs or alert on high-entropy traffic wholesale. Compensating controls: NDR entropy/beaconing analytics, TLS fingerprinting (JA3/JA4), and strict egress allowlisting on server segments.
Compensating controls
- NDR entropy/beaconing analytics on egress traffic
- JA3/JA4 TLS fingerprinting
- Egress allowlisting on server segments (the KEV entry points were internet-facing ManageEngine servers)
- Existing family-tagged T1573 emerging-threat rules (Pikabot, Kalambur)
Revisit when: A corpus family mapped to this technique with a stable single-event observable (fixed port, URI pattern, or handshake bytes) — author a family-scoped rule tagged t1573.001 — or SigmaHQ adopting Zeek conn/ssl entropy-class fields as a logsource convention.