Techniques › T1573 › T1573.002

T1573.002 Asymmetric Cryptography

command and control — ESXi, Linux, macOS, Network Devices, Windows · attack.mitre.org · JSON

KEV CVEs mapped to this technique · CTID Mappings Explorer

None. No KEV entry in the public mapping names this technique. Given that 74.7% of KEV has no mapping at all, this says more about the mapping than about the technique.

Detection strategy · ATT&CK Enterprise v19.2

• DET0543 Detection Strategy for Encrypted Channel via Asymmetric Cryptography across OS Platforms v1.0
  AN1496 Windows

  Processes not typically associated with encryption loading asymmetric crypto libraries (e.g., rsaenh.dll, crypt32.dll) and subsequently initiating outbound TLS/SSL connections with abnormal certificate chains or handshakes. Defender correlates process creation, module load, and unusual encrypted sessions.

  WinEventLog:Sysmon EventCode=7 → DC0016 Module Load

  WinEventLog:Sysmon EventCode=3, 22 → DC0082 Network Connection Creation

  Tunable: AllowedCryptoProcesses CertificateAuthorityList HandshakeTimeout
  AN1497 Linux

  Processes (e.g., bash, python, custom binaries) dynamically linking libcrypto/libssl for RSA key exchange, then creating external connections with abnormal certificate validation or handshake anomalies. Defender observes syscall traces and outbound asymmetric key exchanges from non-SSL-native processes.

  auditd:SYSCALL execve or socket/connect system calls for processes using RSA handshake → DC0032 Process Creation

  linux:syslog Non-standard processes negotiating SSL/TLS key exchanges → DC0038 Application Log Content

  linux:osquery Processes linked with libssl/libcrypto performing network activity → DC0016 Module Load

  Tunable: ExpectedCryptoLibs TrafficAsymmetryRatio
  AN1498 macOS

  Applications or launchd services invoking RSA or public-key routines from the Security framework, followed by outbound SSL/TLS sessions with unrecognized certs or anomalous handshakes. Defender observes unified logs of API calls and suspicious network entropy.

  macos:unifiedlog Process invoking SecKeyCreateRandomKey or asymmetric crypto APIs → DC0032 Process Creation

  macos:unifiedlog TLS connections with abnormal handshake sequence or self-signed cert → DC0085 Network Traffic Content

  Tunable: TrustedDoHEndpoints PayloadEntropyThreshold
  AN1499 ESXi

  VMware services (hostd, vpxa) unexpectedly negotiating asymmetric crypto sessions to external endpoints outside vCenter or update servers. Defender sees encrypted handshakes in logs inconsistent with baseline ESXi communication patterns.

  esxi:vpxd ESXi process initiating asymmetric handshake with external host → DC0038 Application Log Content

  esxcli:network Socket inspection showing RSA key exchange outside baseline endpoints → DC0085 Network Traffic Content

  Tunable: BaselineMgmtHosts
  AN1500 Network Devices

  Encrypted sessions detected with asymmetric key exchange anomalies on non-standard ports or with invalid/malformed certs. Defender correlates NetFlow/IPFIX with IDS/IPS detecting RSA exchanges outside expected TLS flows.

  NSM:Flow Flow records with RSA key exchange on unexpected port → DC0078 Network Traffic Flow

  IDS:TLSInspection Malformed certs, incomplete asymmetric handshakes, or invalid CAs → DC0085 Network Traffic Content

  Tunable: PortProfiles CertValidationPolicy

Sigma rules · SigmaHQ da9bb07d64, tag attack.t1573.002

Rules tagged at the parent level (attack.t1573) 6

These target the parent technique, not this sub-technique specifically. Listed for completeness, not counted as coverage.