Clankerusecase
MITRE ATT&CK detection coverage
 ← Back to main site
Home/ MITRE Matrix/ Command and Control/ T1573

T1573Encrypted Channel

T1573 — Encrypted Channel is a MITRE ATT&CK technique in the Command and Control tactic. Clankerusecase tracks 10 detection use cases covering it and 9 threat-intel articles citing it.

Command and Control
View on the matrix → Filter Detection Library MITRE official spec ↗
10Use cases
9Articles
2Sub-techniques
1Tactic

Sub-techniques (2)

T1573.002 · Asymmetric CryptographyT1573.001 · Symmetric Cryptography

Use cases covering this technique (10)

SSL Certificates with Punycode ESCU actions · hunting P Zeek x509 Certificate with Punycode ESCU actions · hunting P [LLM] linuxFile backdoor WebSocket C2 to intel.se9ly9upbhay.shop and campaign C2 IPs Bespoke c2 · hunting DSΣPDDCS [LLM] Armored Likho Still Sync gRPC C2 beacon (tg4service.com / still.rpc.Sync) Bespoke c2 · alerting DSΣPDDCS [LLM] Hardcoded WebSocket backdoor to 154.92.19.71:39989 (no DNS) Bespoke c2 · hunting DSΣPDDCS [LLM] CornFlake C2 egress from masqueraded svchost32.exe in AppData Bespoke c2 · hunting DSΣPDDCS [LLM] Outbound C2 to PlugX/ShadowPad/Cobalt Strike/Remcos infrastructure targeting Pakistani law enforcement Bespoke c2 · alerting DSΣPDDCS [LLM] Compromised web-application server beaconing to espionage C2 (portal-update implant) Bespoke c2 · hunting DSΣPDDCS [LLM] Cross-platform stealer RAT C2 beacon to 23.254.164.123 Bespoke c2 · alerting DSPDDCS [LLM] HTTPS POST to /startlog with codexui User-Agent (Codex exfil over the wire) Bespoke actions · alerting DSΣPDDCS

Articles citing this technique (9)

crit Suspected China-Nexus Actor Exploits VMware vCenter Flaw, Deploys Babuk-Derived Ransomware art-28
high Armored Likho expands its cyber-espionage toolkit art-62
high Almost Half of Malware Samples Communicate Direct to IP art-132
crit CaptiveCrunch: Midnight Blizzard targets travelers worldwide for malware delivery and credential theft art-151
crit One Target, Two Flags | Rival Espionage Actors Converge On Pakistani Law Enforcement art-309
crit A Forgotten Contributor Account Compromised the Entire Mastra npm Package Scope art-373
crit OceanLotus: From external espionage to domestic targeting art-388
high Legitimate-Looking Codex Remote UI Secretly Steals Your AI Tokens art-434
crit PlushDaemon compromises network devices for adversary-in-the-middle attacks art-803