Wiki › Techniques, Tactics & Procedures (TTPs) › Defense Evasion › Encrypted Payload Delivery

Encrypted Payload Delivery

3 min read

Jump to:

Overview

Encrypted Payload Delivery is a technique used by adversaries to conceal malicious payloads within encrypted or obfuscated data streams during transmission. This method helps attackers evade detection mechanisms by preventing security tools from inspecting the payload content, thereby facilitating successful delivery and execution within a target environment. It is commonly employed across multiple stages of the attack lifecycle to maintain stealth and ensure operational success.

Attack Objective

Primary goal: stealthy delivery of malicious code or commands to evade detection and enable subsequent compromise
Supports stages: Initial Access, Execution, Persistence, Command & Control, and sometimes Lateral Movement
Advances attacker’s position by bypassing network and endpoint defenses, allowing payloads to reach targets without triggering alerts

How the Technique Works

Adversaries encrypt or encode payloads before transmission, embedding them within encrypted channels such as TLS/SSL, proprietary encryption schemes, or custom obfuscation layers. Upon receipt, the payload is decrypted or decoded locally on the compromised system to execute malicious actions. This process prevents content inspection tools from analyzing the payload in transit, reducing the likelihood of detection by signature or heuristic-based defenses.

Common Methods & Variations

Use of standard encryption protocols (e.g., TLS/SSL) to tunnel payloads within legitimate traffic
Custom encryption or encoding schemes embedded in network traffic, email attachments, or file transfers
Variants across environments including on-premises networks, cloud services, endpoint devices, and identity systems
Utilization of living-off-the-land binaries (LOLBins) to decrypt or execute payloads versus deploying custom decryption tools

Indicators of Compromise (IOCs)

Unusual encrypted network sessions to uncommon destinations or at irregular times
Presence of encrypted files or data blobs with anomalous metadata or file extensions
Endpoint logs showing decryption or decoding processes initiated by non-standard applications
Network traffic exhibiting encrypted payloads that deviate from normal protocol behavior or volume patterns

Detection Strategies

Monitoring network telemetry for anomalous encrypted sessions, including destination, timing, and volume anomalies
Behavioral analytics focusing on unusual decryption or decoding activity on endpoints
Correlation of network and endpoint events to identify encrypted payload delivery followed by suspicious execution
Use of metadata analysis and TLS fingerprinting to detect non-standard encrypted communications

Mitigation & Prevention

Enforce strict network segmentation and egress filtering to limit unauthorized encrypted communications
Implement TLS inspection where feasible to enable payload inspection without compromising privacy policies
Apply endpoint controls to restrict execution of unauthorized decryption or decoding utilities
Use strong identity and access management policies to reduce the risk of payload delivery to privileged systems

Response Considerations

Immediately isolate affected systems to prevent further payload execution or lateral movement
Investigate network logs and endpoint telemetry to identify the source and scope of encrypted payload delivery
Conduct forensic analysis on decrypted payloads and associated artifacts to understand attacker intent and capabilities
Harden network and endpoint defenses post-incident, including updating detection rules and reviewing encryption policies

Related Techniques

Command and Control over Encrypted Channels
Obfuscated Files or Information
Living off the Land Binaries and Scripts
Data Encoding and Encryption for Defense Evasion

Mapping & References

MITRE ATT&CK: T1027 – Obfuscated Files or Information; T1573 – Encrypted Channel; T1204 – User Execution
Public research on encrypted command and control communications and payload delivery methods
Security advisories detailing detection and mitigation of encrypted payload delivery in advanced persistent threats

Tags: Command & Control Cyber Attack Techniques Defense Evasion Encrypted Payload endpoint security Execution Initial Access lateral movement network security Payload Delivery persistence Threat Detection