Techniques › T1573 › AN0759
AN0759 Analytic 0759
Windows · attack.mitre.org · ATT&CK Enterprise v19.2
<p>Processes that normally do not initiate network connections establishing outbound encrypted TLS/SSL sessions, especially with asymmetric traffic volumes (client sending more than receiving) or non-standard certificate chains. Defender observations correlate process creation with unexpected network encryption libraries being loaded.</p>
- Detects
- T1573 Encrypted Channel
- Part of
- DET0273 Detection Strategy for Encrypted Channel across OS Platforms
Log sources and channels
Exactly as MITRE states them in x_mitre_log_source_references. Where a channel is vague, it is vague in the source; kevmap does not tidy it.
| Log source | Channel | Data component |
|---|---|---|
| WinEventLog:Sysmon | EventCode=3, 22 | DC0082 Network Connection Creation |
| WinEventLog:Sysmon | EventCode=7 | DC0016 Module Load |
Mutable elements
Parameters MITRE marks as environment-specific. These are the knobs you are expected to tune; they are why an analytic is not a rule.
| Field | Description |
|---|---|
AllowedEncryptedProcesses | Whitelist processes expected to use TLS (e.g., browsers, mail clients). |
EntropyThreshold | Payload randomness threshold to distinguish C2 encryption from legitimate traffic. |
TimeWindow | Correlation window between process creation, module load, and encrypted connection. |