Techniques › T1600
T1600 Weaken Encryption
defense impairment — Network Devices · attack.mitre.org · JSON
1
MITRE detection strategy
1
analytics
0
Sigma rules tagged attack.t1600
0
KEV CVEs mapped here
<p>Adversaries may compromise a network device’s encryption capability in order to bypass encryption that would otherwise protect data communications.</p><p>Encryption can be used to protect transmitted network traffic to maintain its confidentiality (protect against unauthorized disclosure) and integrity (protect against unauthorized changes). Encryption ciphers are used to convert a plaintext message to ciphertext and can be computationally intensive to decipher without the associated decryption key. Typically, longer keys increase the cost of cryptanalysis, or decryption without the key.</p><p>Adversaries can compromise and manipulate devices that perform encryption of network traffic. For example, through behaviors such as Modify System Image, Reduce Key Space, and Disable Crypto Hardware, an adversary can negatively effect and/or eliminate a device’s ability to securely encrypt network traffic. This poses a greater risk of unauthorized disclosure and may help facilitate data manipulation, Credential Access, or Collection efforts.</p>
KEV CVEs mapped to this technique · CTID Mappings Explorer
None. No KEV entry in the public mapping names this technique. Given that 74.7% of KEV has no mapping at all, this says more about the mapping than about the technique.
Detection strategy · ATT&CK Enterprise v19.2
- DET0339 Detection Strategy for Weaken Encryption on Network Devices v1.0
AN0961 Network DevicesDefenders may observe unauthorized modifications to encryption-related configuration files, firmware, or crypto modules on network devices. Suspicious patterns include changes to cipher suite configurations, unexpected firmware updates affecting crypto libraries, disabling of hardware cryptographic accelerators, or reductions in key length policies. Correlating configuration changes with anomalies in encrypted traffic characteristics (e.g., weaker ciphers or sudden plaintext transmission) strengthens detection.networkdevice:config
Configuration change events referencing encryption, TLS/SSL, or IPSec settings→ DC0061 File ModificationNSM:FlowTraffic patterns showing downgrade from strong encryption (AES-256) to weaker or plaintext protocols→ DC0085 Network Traffic Contentsnmp:statusStatus change in cryptographic hardware modules (enabled -> disabled)→ DC0016 Module LoadTunable:CipherSuiteWhitelistTimeWindowAuthorizedFirmwareSourcesTrafficEntropyThreshold
Sigma rules · SigmaHQ da9bb07d64, tag attack.t1600
No Sigma rule carries this tag. MITRE publishes a detection strategy above, so the behaviour is specified; what is missing is public detection content.