T1573 Encrypted Channel

Technique

T1573

Tactics

Command and Control

Research, 90 days

4

KEV CVEs mapped

0

SigmaHQ rules

6

Elastic, Splunk

6

thrunt rules

1

Upstream

https://attack.mitre.org/techniques/T1573

MITRE description

Adversaries may employ an encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.

Research citing this technique

Reports and advisories from the last 90 days that cite this technique.

• 2026-11-04 ESET: SlippyNunchucks hijacks Sogou Input Method’s brand promotion mechanism to distribute malware
• 2026-10-22 ESET: MythicRatatoskr: An Yggdrasil-enabled backdoor deployed in a UAC-0099-Sandworm collaboration
• 2026-10-19 Rapid7: Rapid7 Analysis: NetScaler intrusions chaining CVE-2026-88771 and CVE-2026-88779
• 2026-09-29 Microsoft Threat Intelligence: Phishing Abuses RMM Tools for Persistent Access

Detection coverage

thrunt rules

• t1071-004-doh-resolver-non-browser-c2

SigmaHQ community rules

• Potential Pikabot C2 Activity (emerging-threats)
• Kalambur Backdoor Curl TOR SOCKS Proxy Execution (emerging-threats)
• Activity from Suspicious IP Addresses (core)
• Activity from Anonymous IP Addresses (core)
• Activity from Infrequent Country (core)
• Suspicious SSL Connection (core)

Elastic and Splunk rules

• Openssl Client or Server Activity (elastic)
• Default Cobalt Strike Team Server Certificate (elastic)
• Newly Observed IPSEC NAT Traversal Peer (elastic)
• Potential Self-Signed TLS Certificate Recently Issued on External Connection (elastic)
• Deprecated TLS Version or Weak Cipher Negotiated Externally (elastic)
• Connection to Commonly Abused Free SSL Certificate Providers (elastic)

Signal counts reflect the current corpus snapshot. Research citations are the technique IDs named in vendor reports and government advisories from the last 90 days; KEV mappings come from MITRE CTID. Coverage is the SigmaHQ rule inventory (core, emerging-threats, threat-hunting) at release r2026-07-01 plus Elastic and Splunk production rules. Rule bodies are not mirrored; links go upstream.