Куда я попал?

SECURITM это SGRC система, автоматизирующая процессы в службах информационной безопасности. SECURITM помогает построить и управлять ИСПДн, КИИ, ГИС, СМИБ/СУИБ, банковскими системами защиты.
А еще SECURITM это место для обмена опытом и наработками для служб безопасности.

Подробнее

Encrypted Channel: Асимметричное шифрование

Other sub-techniques of Encrypted Channel (2)

ID	Название
.001	Симметричное шифрование
.002	Асимметричное шифрование

Adversaries may employ a known asymmetric encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Asymmetric cryptography, also known as public key cryptography, uses a keypair per party: one public that can be freely distributed, and one private. Due to how the keys are generated, the sender encrypts data with the receiver’s public key and the receiver decrypts the data with their private key. This ensures that only the intended recipient can read the encrypted data. Common public key encryption algorithms include RSA and ElGamal. For efficiency, many protocols (including SSL/TLS) use symmetric cryptography once a connection is established, but use asymmetric cryptography to establish or transmit a key. As such, these protocols are classified as Asymmetric Cryptography.

ID: T1573.002

Относится к технике: T1573

Тактика(-и): Command and Control

Платформы: Linux, macOS, Network, Windows

Источники данных: Network Traffic: Network Traffic Content

Версия: 1.1

Дата создания: 16 Mar 2020

Последнее изменение: 26 Dec 2023

Название	Описание
Примеры процедур
SombRAT	SombRAT can SSL encrypt C2 traffic.(Citation: BlackBerry CostaRicto November 2020)(Citation: FireEye FiveHands April 2021)(Citation: CISA AR21-126A FIVEHANDS May 2021)
Uroburos	Uroburos has used a combination of a Diffie-Hellman key exchange mixed with a pre-shared key (PSK) to encrypt its top layer of C2 communications.(Citation: Joint Cybersecurity Advisory AA23-129A Snake Malware May 2023)
Cyclops Blink	Cyclops Blink can encrypt C2 messages with AES-256-CBC sent underneath TLS. OpenSSL library functions are also used to encrypt each message using a randomly generated key and IV, which are then encrypted using a hard-coded RSA public key.(Citation: NCSC Cyclops Blink February 2022)
PITSTOP	PITSTOP has the ability to communicate over TLS.(Citation: Mandiant Cutting Edge Part 3 February 2024)
TA2541	TA2541 has used TLS encrypted C2 communications including for campaigns using AsyncRAT.(Citation: Cisco Operation Layover September 2021)
	During Operation Wocao, threat actors' proxy implementation "Agent" upgraded the socket in use to a TLS socket.(Citation: FoxIT Wocao December 2019)
Metamorfo	Metamorfo's C2 communication has been encrypted using OpenSSL.(Citation: Medium Metamorfo Apr 2020)
Sykipot	Sykipot uses SSL for encrypting C2 communications.(Citation: Blasco 2013)
Bazar	Bazar can use TLS in C2 communications.(Citation: Zscaler Bazar September 2020)
TinyTurla	TinyTurla has the ability to encrypt C2 traffic with SSL/TLS.(Citation: Talos TinyTurla September 2021)
LunarWeb	LunarWeb can send short C2 commands, up to 512 bytes, encrypted with RSA-4096.(Citation: ESET Turla Lunar toolset May 2024)
SodaMaster	SodaMaster can use a hardcoded RSA key to encrypt some of its C2 traffic.(Citation: Securelist APT10 March 2021)
ComRAT	ComRAT can use SSL/TLS encryption for its HTTP-based C2 channel. ComRAT has used public key cryptography with RSA and AES encrypted email attachments for its Gmail C2 channel.(Citation: ESET ComRAT May 2020)(Citation: CISA ComRAT Oct 2020)
REvil	REvil has encrypted C2 communications with the ECIES algorithm.(Citation: Kaspersky Sodin July 2019)
Gazer	Gazer uses custom encryption for C2 that uses RSA.(Citation: ESET Gazer Aug 2017)(Citation: Securelist WhiteBear Aug 2017)
Pay2Key	Pay2Key has used RSA encrypted communications with C2.(Citation: Check Point Pay2Key November 2020)
Grandoreiro	Grandoreiro can use SSL in C2 communication.(Citation: IBM Grandoreiro April 2020)
Pupy	Pupy's default encryption for its C2 communication channel is SSL, but it also has transport options for RSA and AES.(Citation: GitHub Pupy)
ServHelper	ServHelper may set up a reverse SSH tunnel to give the attacker access to services running on the victim, such as RDP.(Citation: Proofpoint TA505 Jan 2019)
Mythic	Mythic supports SSL encrypted C2.(Citation: Mythc Documentation)
GrimAgent	GrimAgent can use a hardcoded server public RSA key to encrypt the first request to C2.(Citation: Group IB GrimAgent July 2021)
Attor	Attor's Blowfish key is encrypted with a public RSA key.(Citation: ESET Attor Oct 2019)
Doki	Doki has used the embedTLS library for network communications.(Citation: Intezer Doki July 20)
Dridex	Dridex has encrypted traffic with RSA.(Citation: Kaspersky Dridex May 2017)
WellMess	WellMess can communicate to C2 with mutual TLS where client and server mutually check certificates.(Citation: PWC WellMess July 2020)(Citation: PWC WellMess C2 August 2020)(Citation: CISA WellMess July 2020)(Citation: NCSC APT29 July 2020)
Tropic Trooper	Tropic Trooper has used SSL to connect to C2 servers.(Citation: TrendMicro Tropic Trooper Mar 2018)(Citation: TrendMicro Tropic Trooper May 2020)
Small Sieve	Small Sieve can use SSL/TLS for its HTTPS Telegram Bot API-based C2 channel.(Citation: DHS CISA AA22-055A MuddyWater February 2022)
	Versa Director Zero Day Exploitation used HTTPS for command and control of compromised Versa Director servers.(Citation: Lumen Versa 2024)
LITTLELAMB.WOOLTEA	LITTLELAMB.WOOLTEA can communicate over SSL using the private key from the Ivanti Connect Secure web server.(Citation: Mandiant Cutting Edge Part 3 February 2024)
Carbon	Carbon has used RSA encryption for C2 communications.(Citation: Accenture HyperStack October 2020)
Tor	Tor encapsulates traffic in multiple layers of encryption, using TLS by default.(Citation: Dingledine Tor The Second-Generation Onion Router)
FRP	FRP can be configured to only accept TLS connections.(Citation: FRP GitHub)
GoldMax	GoldMax has RSA-encrypted its communication with the C2 server.(Citation: MSTIC NOBELIUM Mar 2021)
Sliver	Sliver can use mutual TLS and RSA cryptography to exchange a session key.(Citation: Cybersecurity Advisory SVR TTP May 2021)(Citation: Bishop Fox Sliver Framework August 2019)(Citation: GitHub Sliver Encryption)
RedCurl	RedCurl has used HTTPS for C2 communication.(Citation: group-ib_redcurl1)(Citation: group-ib_redcurl2)
Woody RAT	Woody RAT can use RSA-4096 to encrypt data sent to its C2 server.(Citation: MalwareBytes WoodyRAT Aug 2022)
GreyEnergy	GreyEnergy encrypts communications using RSA-2048.(Citation: ESET GreyEnergy Oct 2018)
BADHATCH	BADHATCH can beacon to a hardcoded C2 IP address using TLS encryption every 5 minutes.(Citation: Gigamon BADHATCH Jul 2019)
DarkWatchman	DarkWatchman can use TLS to encrypt its C2 channel.(Citation: Prevailion DarkWatchman 2021)
COATHANGER	COATHANGER connects to command and control infrastructure using SSL.(Citation: NCSC-NL COATHANGER Feb 2024)
Trojan.Karagany	Trojan.Karagany can secure C2 communications with SSL and TLS.(Citation: Secureworks Karagany July 2019)
OilRig	OilRig used the Plink utility and other tools to create tunnels to C2 servers.(Citation: FireEye APT34 Webinar Dec 2017)
Penquin	Penquin can encrypt communications using the BlowFish algorithm and a symmetric key exchanged with Diffie Hellman.(Citation: Leonardo Turla Penquin May 2020)
Machete	Machete has used TLS-encrypted FTP to exfiltrate data.(Citation: Cylance Machete Mar 2017)
Cobalt Strike	Cobalt Strike can use RSA asymmetric encryption with PKCS1 padding to encrypt data sent to the C2 server.(Citation: Talos Cobalt Strike September 2020)
Volgmer	Some Volgmer variants use SSL to encrypt C2 communications.(Citation: US-CERT Volgmer Nov 2017)
Hi-Zor	Hi-Zor encrypts C2 traffic with TLS.(Citation: Fidelis Hi-Zor)
StrongPity	StrongPity has encrypted C2 traffic using SSL/TLS.(Citation: Talos Promethium June 2020)
Rising Sun	Rising Sun variants can use SSL for encrypting C2 communications.(Citation: Bleeping Computer Op Sharpshooter March 2019)
POSHSPY	POSHSPY encrypts C2 traffic with AES and RSA.(Citation: FireEye POSHSPY April 2017)
XTunnel	XTunnel uses SSL/TLS and RC4 to encrypt traffic.(Citation: Invincea XTunnel)(Citation: ESET Sednit Part 2)
	During C0021, the threat actors used SSL via TCP port 443 for C2 communications.(Citation: FireEye APT29 Nov 2018)
KEYPLUG	KEYPLUG can use TLS-encrypted WebSocket Protocol (WSS) for C2.(Citation: Mandiant APT41)
POWERSTATS	POWERSTATS has encrypted C2 traffic with RSA.(Citation: FireEye MuddyWater Mar 2018)
Zebrocy	Zebrocy uses SSL and AES ECB for encrypting C2 communications.(Citation: ESET Zebrocy Nov 2018)(Citation: ESET Zebrocy May 2019)(Citation: CISA Zebrocy Oct 2020)
PoetRAT	PoetRAT used TLS to encrypt command and control (C2) communications.(Citation: Talos PoetRAT April 2020)
Cobalt Group	Cobalt Group has used the Plink utility to create SSH tunnels.(Citation: Group IB Cobalt Aug 2017)
ADVSTORESHELL	A variant of ADVSTORESHELL encrypts some C2 with RSA.(Citation: Bitdefender APT28 Dec 2015)
Mispadu	Mispadu contains a copy of the OpenSSL library to encrypt C2 traffic.(Citation: Segurança Informática URSA Sophisticated Loader 2020)
Sardonic	Sardonic has the ability to send a random 64-byte RC4 key to communicate with actor-controlled C2 servers by using an RSA public key.(Citation: Bitdefender Sardonic Aug 2021)
Koadic	Koadic can use SSL and TLS for communications.(Citation: Github Koadic)
WannaCry	WannaCry uses Tor for command and control traffic and routes a custom cryptographic protocol over the Tor circuit.(Citation: SecureWorks WannaCry Analysis)
FIN6	FIN6 used the Plink command-line utility to create SSH tunnels to C2 servers.(Citation: FireEye FIN6 April 2016)
	APT41 DUST used HTTPS for command and control.(Citation: Google Cloud APT41 2024)
Empire	Empire can use TLS to encrypt its C2 channel.(Citation: Github PowerShell Empire)
FIN8	FIN8 has used the Plink utility to tunnel RDP back to C2 infrastructure.(Citation: FireEye Know Your Enemy FIN8 Aug 2016)
BISCUIT	BISCUIT uses SSL for encrypting C2 communications.(Citation: Mandiant APT1 Appendix)
adbupd	adbupd contains a copy of the OpenSSL library to encrypt C2 traffic.(Citation: Microsoft PLATINUM April 2016)
Kobalos	Kobalos's authentication and key exchange is performed using RSA-512.(Citation: ESET Kobalos Feb 2021)(Citation: ESET Kobalos Jan 2021)
Covenant	Covenant can utilize SSL to encrypt command and control traffic.(Citation: Github Covenant)
WellMail	WellMail can use hard coded client and certificate authority certificates to communicate with C2 over mutual TLS.(Citation: CISA WellMail July 2020)(Citation: NCSC APT29 July 2020)
Operation Wocao	Operation Wocao's proxy implementation "Agent" can upgrade the socket in use to a TLS socket.(Citation: FoxIT Wocao December 2019)
CHOPSTICK	CHOPSTICK encrypts C2 communications with TLS.(Citation: ESET Sednit Part 2)
IcedID	IcedID has used SSL and TLS in communications with C2.(Citation: IBM IcedID November 2017)(Citation: Juniper IcedID June 2020)

Контрмера	Описание
Контрмеры
Network Intrusion Prevention	Use intrusion detection signatures to block traffic at network boundaries.
SSL/TLS Inspection	Break and inspect SSL/TLS sessions to look at encrypted web traffic for adversary activity.

Обнаружение

SSL/TLS inspection is one way of detecting command and control traffic within some encrypted communication channels.(Citation: SANS Decrypting SSL) SSL/TLS inspection does come with certain risks that should be considered before implementing to avoid potential security issues such as incomplete certificate validation.(Citation: SEI SSL Inspection Risks) In general, analyze network data for uncommon data flows (e.g., a client sending significantly more data than it receives from a server). Processes utilizing the network that do not normally have network communication or have never been seen before are suspicious. Analyze packet contents to detect communications that do not follow the expected protocol behavior for the port that is being used.(Citation: University of Birmingham C2)

Ссылки

Связанные риски

Ничего не найдено

Каталоги

Мы используем cookie-файлы, чтобы получить статистику, которая помогает нам улучшить сервис для вас с целью персонализации сервисов и предложений. Вы может прочитать подробнее о cookie-файлах или изменить настройки браузера. Продолжая пользоваться сайтом, вы даёте согласие на использование ваших cookie-файлов и соглашаетесь с Политикой обработки персональных данных.