Asymmetric Cryptography (T1573.002) is a sub-technique of Encrypted Channel in the command and control tactic. The adversary uses a public key algorithm to hide C2 traffic. Each party has a keypair: a public key that can be shared and a private key that cannot. The sender encrypts with the receiver's public key, and only the receiver can decrypt. MITRE names RSA and ElGamal as common examples. Platforms: ESXi, Linux, macOS, network devices and Windows.
One detail from MITRE matters for defenders. For efficiency, protocols such as SSL and TLS use asymmetric cryptography to set up or send a key, then switch to symmetric cryptography. MITRE classifies those protocols here. So ordinary TLS to a hostile server counts.
How attackers use it
At the level MITRE documents, the adversary encrypts C2 with public key cryptography, often through a TLS session, so the channel looks like the web traffic your network sees all day.
How to detect it
MITRE's detection strategy again combines host and network clues.
- Windows: processes not normally tied to encryption loading asymmetric crypto libraries (rsaenh.dll and crypt32.dll are MITRE's examples), then opening outbound TLS or SSL connections with abnormal certificate chains or handshakes.
- Linux: bash, python or custom binaries linking libcrypto or libssl for RSA key exchange, then making external connections with abnormal certificate validation or handshake anomalies.
- macOS: applications or launchd services calling RSA or public key routines from the Security framework, followed by TLS sessions with unrecognized certificates.
- ESXi: hostd or vpxa negotiating asymmetric sessions with external endpoints other than vCenter or update servers.
- Network: key exchange anomalies on non-standard ports, or invalid or malformed certificates. Correlate NetFlow or IPFIX with IDS or IPS detection of RSA exchanges outside expected TLS flows.
Certificate details are a rich source here: self-signed or unusual chains from a process that should never speak TLS deserve a look.
How to reduce the risk
MITRE lists two mitigations.
- Network intrusion prevention to identify traffic for specific adversary malware by signature.
- SSL/TLS inspection to see inside encrypted sessions and look for network-based indicators of malware protocols.
Quick check
Does normal TLS fall under asymmetric cryptography in ATT&CK?
Yes. MITRE says protocols that use asymmetric cryptography to establish or transmit a key, including SSL and TLS, are classified under T1573.002.
