Encrypted Channel, Technique T1573 - Enterprise
Excerpt
ID Name Description
G0016 APT29
APT29 has used multiple layers of encryption within malware to protect C2 communication.[1]
G1002 BITTER BITTER has encrypted their C2 communications.[2] S0631 Chaes Chaes has used encryption for its C2 channel.[3] S0498 Cryptoistic Cryptoistic can engage in encrypted communications with C2.[4] S0367 Emotet Emotet has encrypted data before sending to the C2 server. [5]
S0032 gh0st RAT gh0st RAT has encrypted TCP communications to evade detection.[6] S1198 Gomir
Gomir uses a custom encryption algorithm for content sent to command and control infrastructure.[7]
C0035 KV Botnet Activity
KV Botnet Activity command and control activity includes transmission of an RS…
The opening of the report, shown for reference. The full report, with its figures and indicators, is published by MITRE ATT&CK on attack.mitre.org.
Mentioned in the excerpt
More from MITRE ATT&CK43
- techdoc_lite-deliverables-numbered option.dotxMITRE ATT&CK · Added 16 Jun
- Cross-Platform Detection of Data Transfer to Cloud Account, Detection Strategy DET0573MITRE ATT&CK · Added 6 Apr
- Boot or Logon Autostart Execution: Time Providers, Sub-technique T1547.003 - EnterpriseMITRE ATT&CK · Added 6 Apr
- Boot or Logon Autostart Execution: LSASS Driver, Sub-technique T1547.008 - EnterpriseMITRE ATT&CK · Added 6 Apr
On the same topics
- Kazuar: Anatomy of a nation-state botnetMicrosoft · Published 14 May
- Encrypted Channel, Technique T1573 - EnterpriseMITRE ATT&CK · Added 6 Apr
- Silent Push Identifies More Than 10,000 Infected IPs as Part of SystemBC Botnet Malware FamilySilent Push · Published 4 Feb
