Symmetric Cryptography (T1573.001) is a sub-technique of Encrypted Channel in the command and control tactic. The adversary uses a known symmetric algorithm to conceal C2 traffic instead of relying on protections built into the protocol. Symmetric means one key both encrypts and decrypts. MITRE names AES, DES, 3DES, Blowfish and RC4 as common examples. Platforms: ESXi, Linux, macOS, network devices and Windows.
How attackers use it
MITRE keeps the description short. The adversary picks a well-known symmetric cipher and wraps their own C2 messages with it. Because the cipher is standard, there is no special handshake to fingerprint, which is the point.
How to detect it
MITRE's strategy pairs host behavior with network shape.
- Windows: processes that do not usually perform cryptography loading symmetric crypto libraries (MITRE cites bcryptprimitives.dll and aes.dll), then making outbound connections with high-entropy payloads. Correlate process creation, the library load and the odd encrypted traffic.
- Linux: unexpected processes such as bash, python or custom binaries loading libcrypto or doing AES or RC4 operations, then starting outbound sessions with abnormal byte entropy or lopsided traffic.
- macOS: launchd jobs or user processes calling symmetric crypto APIs in the Security framework, then connecting out with randomized payloads that do not look like normal TLS.
- ESXi: hostd or vpxa using symmetric encryption routines for external connections, with encrypted payloads that do not match the VMware management baseline.
- Network: flows with high-entropy encrypted payloads that do not match a TLS handshake, especially on non-standard ports. NetFlow or IPFIX byte distribution anomalies, or IDS and IPS alerts for symmetric encryption without a key exchange.
The useful tell is a missing key exchange. Legitimate encrypted protocols start with a handshake. Raw encrypted bytes on an odd port do not.
How to reduce the risk
MITRE lists one mitigation: network intrusion prevention. Signature-based systems can identify traffic for specific adversary malware at the network level. Pair it with egress filtering so odd ports cannot leave the network at all (see T1571).
Quick check
What network clue separates this from normal TLS?
High-entropy encrypted payloads with no TLS handshake or key exchange, particularly on non-standard ports.
