Wiki › Techniques, Tactics & Procedures (TTPs) › Command & Control › Encrypted Command and Control Channels

Encrypted Command and Control Channels

2 min read

Jump to:

Overview

Encrypted Command and Control (C2) Channels are communication pathways used by adversaries to securely transmit commands and receive data from compromised systems while evading detection. This technique plays a critical role in maintaining persistent control over victim environments during the Command & Control phase of the attack lifecycle. Encryption helps adversaries conceal their traffic from network monitoring and defensive tools.

Attack Objective

Maintain covert and reliable control over compromised assets
Supports the Command & Control stage, often enabling Persistence, Lateral Movement, and Exfiltration
Advances attacker position by preventing interception and analysis of C2 communications, thereby reducing the risk of disruption

How the Technique Works

Adversaries establish communication channels between compromised hosts and external infrastructure using encryption protocols or custom cryptographic methods. These channels transmit commands, receive responses, and sometimes exfiltrate data. Encryption obscures the content and sometimes the metadata of the communications, hindering detection by signature-based and heuristic network defenses.

Common Methods & Variations

Use of standard protocols with encryption such as HTTPS, TLS, SSH, or VPN tunnels
Custom encrypted protocols layered over common ports (e.g., TCP 443) to blend with legitimate traffic
Implementation in on-premises networks, cloud environments, endpoints, and identity services
Living-off-the-land approaches leveraging legitimate encryption tools versus custom-developed malware encryption

Indicators of Compromise (IOCs)

Unusual encrypted outbound connections to rare or suspicious domains or IP addresses
Network traffic exhibiting irregular session patterns despite encryption
Endpoint artifacts such as unusual processes initiating encrypted connections
Cloud logs showing anomalous encrypted data flows or access patterns

Detection Strategies

Network telemetry including SSL/TLS inspection metadata, flow analysis, and anomaly detection
Behavioral detection focusing on unusual encrypted communication patterns rather than payload content
Correlation of endpoint process activity with network connections to identify suspicious encrypted channels

Mitigation & Prevention

Enforce strict egress filtering and network segmentation to limit unauthorized encrypted connections
Deploy SSL/TLS interception and inspection where privacy policies and regulations permit
Implement strong identity and access management controls to reduce compromised credentials used in C2

Response Considerations

Immediately isolate affected systems to disrupt encrypted C2 channels
Investigate network logs and endpoint telemetry to identify scope and infrastructure involved
Harden network defenses and update detection rules to prevent re-establishment of encrypted C2

Related Techniques

Use of Standard Application Layer Protocols for C2
Data Obfuscation and Encryption
Credential Access facilitating encrypted C2 authentication
Lateral Movement leveraging encrypted channels

Mapping & References

MITRE ATT&CK: Command and Control (TA0011), Encrypted Channel (T1573)
Public research on encrypted C2 detection and mitigation from cybersecurity vendors and incident reports

Tags: Adversary Tactics Command and Control Cyber Defense Cyberattack Techniques encryption Incident Response Malware Communication MITRE ATT&CK network security Threat Detection