MITRE ATT&CK - Техника Симметричное шифрование

Куда я попал?

SECURITM это SGRC система, автоматизирующая процессы в службах информационной безопасности. SECURITM помогает построить и управлять ИСПДн, КИИ, ГИС, СМИБ/СУИБ, банковскими системами защиты.
А еще SECURITM это место для обмена опытом и наработками для служб безопасности.

Подробнее

Наш канал

Encrypted Channel: Симметричное шифрование

Other sub-techniques of Encrypted Channel (2)

ID	Название
.001	Симметричное шифрование
.002	Асимметричное шифрование

Adversaries may employ a known symmetric encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Symmetric encryption algorithms use the same key for plaintext encryption and ciphertext decryption. Common symmetric encryption algorithms include AES, DES, 3DES, Blowfish, and RC4.

ID: T1573.001

Относится к технике: T1573

Тактика(-и): Command and Control

Платформы: Linux, macOS, Windows

Источники данных: Network Traffic: Network Traffic Content

Версия: 1.0

Дата создания: 16 Mar 2020

Последнее изменение: 26 Mar 2020

Название	Описание
Примеры процедур
Dridex	Dridex has encrypted traffic with RC4.(Citation: Kaspersky Dridex May 2017)
SMOKEDHAM	SMOKEDHAM has encrypted its C2 traffic with RC4.(Citation: FireEye SMOKEDHAM June 2021)
InvisiMole	InvisiMole uses variations of a simple XOR encryption routine for C&C communications.(Citation: ESET InvisiMole June 2018)
Prikormka	Prikormka encrypts some C2 traffic with the Blowfish cipher.(Citation: ESET Operation Groundbait)
3PARA RAT	3PARA RAT command and control commands are encrypted within the HTTP C2 channel using the DES algorithm in CBC mode with a key derived from the MD5 hash of the string HYF54&%9&jkMCXuiS. 3PARA RAT will use an 8-byte XOR key derived from the string HYF54&%9&jkMCXuiS if the DES decoding fails(Citation: CrowdStrike Putter Panda)
NETEAGLE	NETEAGLE will decrypt resources it downloads with HTTP requests by using RC4 with the key "ScoutEagle."(Citation: FireEye APT30)
Machete	Machete has used AES to exfiltrate documents.(Citation: ESET Machete July 2019)
Azorult	Azorult can encrypt C2 traffic using XOR.(Citation: Unit42 Azorult Nov 2018)(Citation: Proofpoint Azorult July 2018)
Bisonal	Bisonal variants reported on in 2014 and 2015 used a simple XOR cipher for C2. Some Bisonal samples encrypt C2 communications with RC4.(Citation: Unit 42 Bisonal July 2018)(Citation: Kaspersky CactusPete Aug 2020)(Citation: Talos Bisonal Mar 2020)
Sys10	Sys10 uses an XOR 0x1 loop to encrypt its C2 domain.(Citation: Baumgartner Naikon 2015)
Elise	Elise encrypts exfiltrated data with RC4.(Citation: Lotus Blossom Jun 2015)
Winnti for Windows	Winnti for Windows can XOR encrypt C2 traffic.(Citation: Novetta Winnti April 2015)
Pandora	Pandora has the ability to encrypt communications with D3DES.(Citation: Trend Micro Iron Tiger April 2021)
BADNEWS	BADNEWS encrypts C2 data with a ROR by 3 and an XOR by 0x23.(Citation: Forcepoint Monsoon)(Citation: TrendMicro Patchwork Dec 2017)
NDiskMonitor	NDiskMonitor uses AES to encrypt certain information sent over its C2 channel.(Citation: TrendMicro Patchwork Dec 2017)
Mustang Panda	Mustang Panda has encrypted C2 communications with RC4.(Citation: Recorded Future REDDELTA July 2020)
Darkhotel	Darkhotel has used AES-256 and 3DES for C2 communications.(Citation: Microsoft DUBNIUM July 2016)
Attor	Attor has encrypted data symmetrically using a randomly generated Blowfish (OFB) key which is encrypted with a public RSA key.(Citation: ESET Attor Oct 2019)
Lurid	Lurid performs XOR encryption.(Citation: Villeneuve 2011)
StrifeWater	StrifeWater can encrypt C2 traffic using XOR with a hard coded key.(Citation: Cybereason StrifeWater Feb 2022)
Chaos	Chaos provides a reverse shell connection on 8338/TCP, encrypted via AES.(Citation: Chaos Stolen Backdoor)
POWERTON	POWERTON has used AES for encrypting C2 traffic.(Citation: FireEye APT33 Guardrail)
SUNBURST	SUNBURST encrypted C2 traffic using a single-byte-XOR cipher.(Citation: FireEye SUNBURST Backdoor December 2020)
More_eggs	More_eggs has used an RC4-based encryption method for its C2 communications.(Citation: Security Intelligence More Eggs Aug 2019)
Hikit	Hikit performs XOR encryption.(Citation: Novetta-Axiom)
NETWIRE	NETWIRE can use AES encryption for C2 data transferred.(Citation: Red Canary NETWIRE January 2020)
Helminth	Helminth encrypts data sent to its C2 server over HTTP with RC4.(Citation: Palo Alto OilRig May 2016)
QuasarRAT	QuasarRAT uses AES with a hardcoded pre-shared key to encrypt network communication.(Citation: GitHub QuasarRAT)(Citation: Volexity Patchwork June 2018)(Citation: CISA AR18-352A Quasar RAT December 2018)
HotCroissant	HotCroissant has compressed network communications and encrypted them with a custom stream cipher.(Citation: Carbon Black HotCroissant April 2020)(Citation: US-CERT HOTCROISSANT February 2020)
Bonadan	Bonadan can XOR-encrypt C2 communications.(Citation: ESET ForSSHe December 2018)
Lucifer	Lucifer can perform a decremental-xor encryption on the initial C2 request before sending it over the wire.(Citation: Unit 42 Lucifer June 2020)
Taidoor	Taidoor uses RC4 to encrypt the message body of HTTP content.(Citation: TrendMicro Taidoor)(Citation: CISA MAR-10292089-1.v2 TAIDOOR August 2021)
Hi-Zor	Hi-Zor encrypts C2 traffic with a double XOR using two distinct single-byte keys.(Citation: Fidelis Hi-Zor)
FALLCHILL	FALLCHILL encrypts C2 data with RC4 encryption.(Citation: US-CERT FALLCHILL Nov 2017)(Citation: CISA AppleJeus Feb 2021)
Mosquito	Mosquito uses a custom encryption algorithm, which consists of XOR and a stream that is similar to the Blum Blum Shub algorithm.(Citation: ESET Turla Mosquito Jan 2018)
Dipsind	Dipsind encrypts C2 data with AES256 in ECB mode.(Citation: Microsoft PLATINUM April 2016)
CharmPower	CharmPower can send additional modules over C2 encrypted with a simple substitution cipher.(Citation: Check Point APT35 CharmPower January 2022)
BADCALL	BADCALL encrypts C2 traffic using an XOR/ADD cipher.(Citation: US-CERT BADCALL)
WarzoneRAT	WarzoneRAT can encrypt its C2 with RC4 with the password `warzone160\x00`.(Citation: Check Point Warzone Feb 2020)
HAMMERTOSS	Before being appended to image files, HAMMERTOSS commands are encrypted with a key composed of both a hard-coded value and a string contained on that day's tweet. To decrypt the commands, an investigator would need access to the intended malware sample, the day's tweet, and the image file containing the command.(Citation: FireEye APT29)
SideTwist	SideTwist can encrypt C2 communications with a randomly generated key.(Citation: Check Point APT34 April 2021)
Emissary	The C2 server response to a beacon sent by a variant of Emissary contains a 36-character GUID value that is used as an encryption key for subsequent network communications. Some variants of Emissary use various XOR operations to encrypt C2 data.(Citation: Lotus Blossom Dec 2015)
FakeM	The original variant of FakeM encrypts C2 traffic using a custom encryption cipher that uses an XOR key of “YHCRA” and bit rotation between each XOR operation. Some variants of FakeM use RC4 to encrypt C2 traffic.(Citation: Scarlet Mimic Jan 2016)
QakBot	QakBot can RC4 encrypt strings in C2 communication.(Citation: Kaspersky QakBot September 2021)
Lazarus Group	Several Lazarus Group malware families encrypt C2 traffic using custom code that uses XOR with an ADD operation and XOR with a SUB operation. Another Lazarus Group malware sample XORs C2 traffic. Other Lazarus Group malware uses Caracachs encryption to encrypt C2 payloads. Lazarus Group has also used AES to encrypt C2 traffic.(Citation: Novetta Blockbuster)(Citation: Novetta Blockbuster Destructive Malware)(Citation: McAfee Lazarus Resurfaces Feb 2018)(Citation: McAfee GhostSecret)(Citation: McAfee Lazarus Jul 2020)
Mongall	Mongall has the ability to RC4 encrypt C2 communications.(Citation: SentinelOne Aoqin Dragon June 2022)
Cardinal RAT	Cardinal RAT uses a secret key with a series of XOR and addition operations to encrypt C2 traffic.(Citation: PaloAlto CardinalRat Apr 2017)
Sakula	Sakula encodes C2 traffic with single-byte XOR keys.(Citation: Dell Sakula)
ZIRCONIUM	ZIRCONIUM has used AES encrypted communications in C2.(Citation: Zscaler APT31 Covid-19 October 2020)
Volgmer	Volgmer uses a simple XOR cipher to encrypt traffic and files.(Citation: US-CERT Volgmer 2 Nov 2017)
httpclient	httpclient encrypts C2 content with XOR using a single byte, 0x12.(Citation: CrowdStrike Putter Panda)
HiddenWasp	HiddenWasp uses an RC4-like algorithm with an already computed PRGA generated key-stream for network communication.(Citation: Intezer HiddenWasp Map 2019)
MoonWind	MoonWind encrypts C2 traffic using RC4 with a static key.(Citation: Palo Alto MoonWind March 2017)
GrimAgent	GrimAgent can use an AES key to encrypt C2 communications.(Citation: Group IB GrimAgent July 2021)
UPPERCUT	Some versions of UPPERCUT have used the hard-coded string “this is the encrypt key” for Blowfish encryption when communicating with a C2. Later versions have hard-coded keys uniquely for each C2 address.(Citation: FireEye APT10 Sept 2018)
4H RAT	4H RAT obfuscates C2 communication using a 1-byte XOR with the key 0xBE.(Citation: CrowdStrike Putter Panda)
Winnti for Linux	Winnti for Linux has used a custom TCP protocol with four-byte XOR for command and control (C2).(Citation: Chronicle Winnti for Linux May 2019)
TrickBot	TrickBot uses a custom crypter leveraging Microsoft’s CryptoAPI to encrypt C2 traffic.(Citation: Fidelis TrickBot Oct 2016)Newer versions of TrickBot have been known to use `bcrypt` to encrypt and digitally sign responses to their C2 server. (Citation: Bitdefender Trickbot C2 infra Nov 2020)
Stealth Falcon	Stealth Falcon malware encrypts C2 traffic using RC4 with a hard-coded key.(Citation: Citizen Lab Stealth Falcon May 2016)
Stuxnet	Stuxnet encodes the payload of system information sent to the command and control servers using a one byte 0xFF XOR key. Stuxnet also uses a 31-byte long static byte string to XOR data sent to command and control servers. The servers use a different static key to encrypt replies to the implant.(Citation: Symantec W.32 Stuxnet Dossier)
Torisma	Torisma has encrypted its C2 communications using XOR and VEST-32.(Citation: McAfee Lazarus Nov 2020)
Ebury	Ebury has encrypted C2 traffic using the client IP address, then encoded it as a hexadecimal string.(Citation: ESET Ebury Feb 2014)
RDAT	RDAT has used AES ciphertext to encode C2 communications.(Citation: Unit42 RDAT July 2020)
XCSSET	XCSSET uses RC4 encryption over TCP to communicate with its C2 server.(Citation: trendmicro xcsset xcode project 2020)
Bazar	Bazar can send C2 communications with XOR encryption.(Citation: NCC Group Team9 June 2020)
Frankenstein	Frankenstein has communicated with a C2 via an encrypted RC4 byte stream and AES-CBC.(Citation: Talos Frankenstein June 2019)
Duqu	The Duqu command and control protocol's data stream can be encrypted with AES-CBC.(Citation: Symantec W32.Duqu)
Rifdoor	Rifdoor has encrypted command and control (C2) communications with a stream cipher.(Citation: Carbon Black HotCroissant April 2020)
Hydraq	Hydraq C2 traffic is encrypted using bitwise NOT and XOR operations.(Citation: Symantec Hydraq Jan 2010)
BBSRAT	BBSRAT uses a custom encryption algorithm on data sent back to the C2 server over HTTP.(Citation: Palo Alto Networks BBSRAT)
MuddyWater	MuddyWater has used AES to encrypt C2 responses.(Citation: Talos MuddyWater Jan 2022)
ADVSTORESHELL	A variant of ADVSTORESHELL encrypts some C2 with 3DES.(Citation: Bitdefender APT28 Dec 2015)
LightNeuron	LightNeuron uses AES to encrypt C2 traffic.(Citation: ESET LightNeuron May 2019)
Explosive	Explosive has encrypted communications with the RC4 method.(Citation: ClearSky Lebanese Cedar Jan 2021)
RTM	RTM encrypts C2 traffic with a custom RC4 variant.(Citation: ESET RTM Feb 2017)
LookBack	LookBack uses a modified version of RC4 for data transfer.(Citation: Proofpoint LookBack Malware Aug 2019)
TAINTEDSCRIBE	TAINTEDSCRIBE uses a Linear Feedback Shift Register (LFSR) algorithm for network encryption.(Citation: CISA MAR-10288834-2.v1 TAINTEDSCRIBE MAY 2020)
Kobalos	Kobalos's post-authentication communication channel uses a 32-byte-long password with RC4 for inbound and outbound traffic.(Citation: ESET Kobalos Feb 2021)(Citation: ESET Kobalos Jan 2021)
gh0st RAT	gh0st RAT uses RC4 and XOR to encrypt C2 traffic.(Citation: Nccgroup Gh0st April 2018)
SombRAT	SombRAT has encrypted its C2 communications with AES.(Citation: BlackBerry CostaRicto November 2020)
WellMess	WellMess can encrypt HTTP POST data using RC6 and a dynamically generated AES key encrypted with a hard coded RSA public key.(Citation: PWC WellMess July 2020)(Citation: PWC WellMess C2 August 2020)(Citation: CISA WellMess July 2020)
Downdelph	Downdelph uses RC4 to encrypt C2 responses.(Citation: ESET Sednit Part 3)
Comnie	Comnie encrypts command and control communications with RC4.(Citation: Palo Alto Comnie)
BendyBear	BendyBear communicates to a C2 server over port 443 using modified RC4 and XOR-encrypted chunks.(Citation: Unit42 BendyBear Feb 2021)
PipeMon	PipeMon communications are RC4 encrypted.(Citation: ESET PipeMon May 2020)
HyperStack	HyperStack has used RSA encryption for C2 communications.(Citation: Accenture HyperStack October 2020)
Gazer	Gazer uses custom encryption for C2 that uses 3DES.(Citation: ESET Gazer Aug 2017)(Citation: Securelist WhiteBear Aug 2017)
NanoCore	NanoCore uses DES to encrypt the C2 traffic.(Citation: PaloAlto NanoCore Feb 2016)
Derusbi	Derusbi obfuscates C2 traffic with variable 4-byte XOR keys.(Citation: Fidelis Turbo)
Carbanak	Carbanak encrypts the message body of HTTP traffic with RC2 (in CBC mode). Carbanak also uses XOR with random keys for its communications.(Citation: Kaspersky Carbanak)(Citation: FireEye CARBANAK June 2017)
xCaon	xCaon has encrypted data sent to the C2 server using a XOR key.(Citation: Checkpoint IndigoZebra July 2021)
Okrum	Okrum uses AES to encrypt network traffic. The key can be hardcoded or negotiated with the C2 server in the registration phase. (Citation: ESET Okrum July 2019)
Higaisa	Higaisa used AES-128 to encrypt C2 traffic.(Citation: Zscaler Higaisa 2020)
PoisonIvy	PoisonIvy uses the Camellia cipher to encrypt communications.(Citation: FireEye Poison Ivy)
Bumblebee	Bumblebee can encrypt C2 requests and responses with RC4(Citation: Proofpoint Bumblebee April 2022)
GreyEnergy	GreyEnergy encrypts communications using AES256.(Citation: ESET GreyEnergy Oct 2018)
Sliver	Sliver can use AES-GCM-256 to encrypt a session key for C2 message exchange.(Citation: GitHub Sliver Encryption)
SodaMaster	SodaMaster can use RC4 to encrypt C2 communications.(Citation: Securelist APT10 March 2021)
RedLeaves	RedLeaves has encrypted C2 traffic with RC4, previously using keys of 88888888 and babybear.(Citation: PWC Cloud Hopper Technical Annex April 2017)
FlawedAmmyy	FlawedAmmyy has used SEAL encryption during the initial C2 handshake.(Citation: Proofpoint TA505 Mar 2018)
Epic	Epic encrypts commands from the C2 server using a hardcoded key.(Citation: Kaspersky Turla)
CallMe	CallMe uses AES to encrypt C2 traffic.(Citation: Scarlet Mimic Jan 2016)
TSCookie	TSCookie has encrypted network communications with RC4.(Citation: JPCert TSCookie March 2018)
Komplex	The Komplex C2 channel uses an 11-byte XOR algorithm to hide data.(Citation: Sofacy Komplex Trojan)
PlugX	PlugX can use RC4 encryption in C2 communications.(Citation: Proofpoint TA416 Europe March 2022)
Cobalt Strike	Cobalt Strike has the ability to use AES-256 symmetric encryption in CBC mode with HMAC-SHA-256 to encrypt task commands and XOR to encrypt shell code and configuration data.(Citation: Talos Cobalt Strike September 2020)
SeaDuke	SeaDuke C2 traffic has been encrypted with RC4 and AES.(Citation: Mandiant No Easy Breach)(Citation: Unit 42 SeaDuke 2015)
RIPTIDE	APT12 has used the RIPTIDE RAT, which communicates over HTTP with a payload encrypted with RC4.(Citation: Moran 2014)
H1N1	H1N1 encrypts C2 traffic using an RC4 key.(Citation: Cisco H1N1 Part 2)
Inception	Inception has encrypted network communications with AES.(Citation: Kaspersky Cloud Atlas December 2014)
KONNI	KONNI has used AES to encrypt C2 traffic.(Citation: Malwarebytes KONNI Evolves Jan 2022)
Daserf	Daserf uses RC4 encryption to obfuscate HTTP traffic.(Citation: Secureworks BRONZE BUTLER Oct 2017)
ZeroT	ZeroT has used RC4 to encrypt C2 traffic.(Citation: Proofpoint TA459 April 2017)(Citation: Proofpoint ZeroT Feb 2017)
FatDuke	FatDuke can AES encrypt C2 communications.(Citation: ESET Dukes October 2019)
KEYMARBLE	KEYMARBLE uses a customized XOR algorithm to encrypt C2 communications.(Citation: US-CERT KEYMARBLE Aug 2018)
Bandook	Bandook has used AES encryption for C2 communication.(Citation: CheckPoint Bandook Nov 2020)
IceApple	The IceApple Result Retriever module can AES encrypt C2 responses.(Citation: CrowdStrike IceApple May 2022)
APT33	APT33 has used AES for encryption of command and control traffic.(Citation: FireEye APT33 Guardrail)
RainyDay	RainyDay can use RC4 to encrypt C2 communications.(Citation: Bitdefender Naikon April 2021)
PLAINTEE	PLAINTEE encodes C2 beacons using XOR.(Citation: Rancor Unit42 June 2018)
FoggyWeb	FoggyWeb has used a dynamic XOR key and custom XOR methodology for C2 communications.(Citation: MSTIC FoggyWeb September 2021)
BLINDINGCAN	BLINDINGCAN has encrypted its C2 traffic with RC4.(Citation: US-CERT BLINDINGCAN Aug 2020)
ChChes	ChChes can encrypt C2 traffic with AES or RC4.(Citation: Palo Alto menuPass Feb 2017)(Citation: JPCERT ChChes Feb 2017)
APT28	APT28 installed a Delphi backdoor that used a custom algorithm for C2 communications.(Citation: ESET Zebrocy May 2019)
BRONZE BUTLER	BRONZE BUTLER has used RC4 encryption (for Datper malware) and AES (for xxmm malware) to obfuscate HTTP traffic. BRONZE BUTLER has also used a tool called RarStar that encodes data with a custom XOR algorithm when posting it to a C2 server.(Citation: Secureworks BRONZE BUTLER Oct 2017)
Metamorfo	Metamorfo has encrypted C2 commands with AES-256.(Citation: ESET Casbaneiro Oct 2019)
SNUGRIDE	SNUGRIDE encrypts C2 traffic using AES with a static key.(Citation: FireEye APT10 April 2017)
PLEAD	PLEAD has used RC4 encryption to download modules.(Citation: JPCert PLEAD Downloader June 2018)
CHOPSTICK	CHOPSTICK encrypts C2 communications with RC4.(Citation: ESET Sednit Part 2)
CORESHELL	CORESHELL C2 messages are encrypted with custom stream ciphers using six-byte or eight-byte keys.(Citation: FireEye APT28)
down_new	down_new has the ability to AES encrypt C2 communications.(Citation: Trend Micro Tick November 2019)
Felismus	Some Felismus samples use a custom encryption method for C2 traffic that utilizes AES and multiple keys.(Citation: Forcepoint Felismus Mar 2017)
	During Frankenstein, the threat actors communicated with C2 via an encrypted RC4 byte stream and AES-CBC.(Citation: Talos Frankenstein June 2019)
Nebulae	Nebulae can use RC4 and XOR to encrypt C2 communications.(Citation: Bitdefender Naikon April 2021)
CosmicDuke	CosmicDuke contains a custom version of the RC4 algorithm that includes a programming error.(Citation: F-Secure Cosmicduke)
PingPull	PingPull can use AES, in cipher block chaining (CBC) mode padded with PKCS5, to encrypt C2 server communications.(Citation: Unit 42 PingPull Jun 2022)

Контрмера	Описание
Контрмеры
Network Intrusion Prevention	Use intrusion detection signatures to block traffic at network boundaries.

Обнаружение

With symmetric encryption, it may be possible to obtain the algorithm and key from samples and use them to decode network traffic to detect malware communications signatures. In general, analyze network data for uncommon data flows (e.g., a client sending significantly more data than it receives from a server). Processes utilizing the network that do not normally have network communication or have never been seen before are suspicious. Analyze packet contents to detect communications that do not follow the expected protocol behavior for the port that is being used.(Citation: University of Birmingham C2)

Ссылки

Связанные риски

Ничего не найдено

Каталоги

Мы используем cookie-файлы, чтобы получить статистику, которая помогает нам улучшить сервис для вас с целью персонализации сервисов и предложений. Вы может прочитать подробнее о cookie-файлах или изменить настройки браузера. Продолжая пользоваться сайтом, вы даёте согласие на использование ваших cookie-файлов и соглашаетесь с Политикой обработки персональных данных.