Encrypted Channel
Technique · ATTACK:enterprise:T1573
Attributed source ↗ · Plaintext record · Complete record and assertions JSON
Inspect structured metadata and provenance
{
"id": "ATTACK:enterprise:T1573",
"title": "Encrypted Channel",
"type": "Technique",
"source_url": "https://attack.mitre.org/techniques/T1573",
"snapshot": "enterprise-attack-20.0.json",
"status": "active",
"rights": "Source metadata only; source notices retained; no operational prose or payloads",
"review_status": "machine-extracted; source-specific checks passed, editorial review pending",
"stix_id": "attack-pattern--b8902400-e6c5-4ba2-95aa-2d35b442b118",
"external_id": "T1573",
"domain": "enterprise",
"created": "2020-03-16T15:33:01.739Z",
"modified": "2026-09-03T19:46:48.529Z",
"version": "1.2",
"aliases": [
],
"tactics": [
"command-and-control"
],
"source_references": [
{
"source_name": "SANS Decrypting SSL",
"url": "http://www.sans.org/reading-room/whitepapers/analyst/finding-hidden-threats-decrypting-ssl-34840"
},
{
"source_name": "SEI SSL Inspection Risks",
"url": "https://insights.sei.cmu.edu/cert/2015/03/the-risks-of-ssl-inspection.html"
},
{
"source_name": "University of Birmingham C2",
"url": "https://arxiv.org/pdf/1408.1136"
}
]
}Explicit source assertions (21)
First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.
ATTACK:enterprise:S0662 → uses → ATTACK:enterprise:T1573
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--0a47636e-8260-414d-aff7-7b1120778a51
Secureworks BRONZE PRESIDENT December 2019ATTACK:enterprise:S0498 → uses → ATTACK:enterprise:T1573
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--0d6e04e8-8e4c-4ef6-ab6a-12ddb498e93a
SentinelOne Lazarus macOS July 2020ATTACK:enterprise:S1198 → uses → ATTACK:enterprise:T1573
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--1532b910-6bf8-4622-a183-0bb7fd18c4ae
Symantec Troll Stealer 2024ATTACK:enterprise:S0631 → uses → ATTACK:enterprise:T1573
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--1d182249-ed44-4e5b-877c-178760379015
Cybereason Chaes Nov 2020ATTACK:enterprise:G0081 → uses → ATTACK:enterprise:T1573
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--3089fe6b-36d6-4890-b70b-1a76f55c84ff
TrendMicro Tropic Trooper May 2020ATTACK:enterprise:S1046 → uses → ATTACK:enterprise:T1573
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--3c5b31ff-ba6a-47c0-adbe-ddd18845f684
DHS CISA AA22-055A MuddyWater February 2022ATTACK:enterprise:T1573.002 → subtechnique-of → ATTACK:enterprise:T1573
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--4fcc0674-fe6d-4977-9259-1832282a3997
ATTACK:enterprise:G0059 → uses → ATTACK:enterprise:T1573
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--665e5a7f-e575-44c7-839d-4c69f14238d2
DFIR Phosphorus November 2021ATTACK:enterprise:S1012 → uses → ATTACK:enterprise:T1573
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--7340fcbe-e87b-4f16-bdac-e429a0ba7714
Cybereason PowerLess February 2022ATTACK:enterprise:G1002 → uses → ATTACK:enterprise:T1573
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--79192884-411c-490d-a28e-f923be7070e3
Forcepoint BITTER Pakistan Oct 2016ATTACK:enterprise:C0035 → uses → ATTACK:enterprise:T1573
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--a53827f4-1b98-422e-b6fd-0504c3f05a73
Lumen KVBotnet 2023ATTACK:enterprise:G0016 → uses → ATTACK:enterprise:T1573
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--a8981fca-0584-4e9e-8f92-83843e1e4462
Secureworks IRON HEMLOCK ProfileATTACK:enterprise:T1573.001 → subtechnique-of → ATTACK:enterprise:T1573
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--bccb7ac3-c374-445b-aad2-14991a8641e5
ATTACK:enterprise:M1031 → mitigates → ATTACK:enterprise:T1573
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--c1b721af-9d2b-47a2-a712-3bff64628148
ATTACK:enterprise:S0681 → uses → ATTACK:enterprise:T1573
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--c77046c5-1ea2-4d3f-a19e-0ea7141d7e9c
BiZone Lizar May 2021 · Cocomazzi FIN7 Reboot · Threatpost Lizar May 2021ATTACK:enterprise:S0032 → uses → ATTACK:enterprise:T1573
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--cc2de45c-a1f3-4085-ac35-dffa8a86e9b3
Gh0stRAT ATT March 2019ATTACK:enterprise:M1020 → mitigates → ATTACK:enterprise:T1573
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--d62449f0-cecd-466f-b3e8-c6908f48cfaa
ATTACK:enterprise:C0030 → uses → ATTACK:enterprise:T1573
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--eb4c544b-2c30-4d61-aaee-13a7bf21a182
FireEye TEMP.Veles 2018ATTACK:enterprise:S0198 → uses → ATTACK:enterprise:T1573
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--ee35c721-0b74-4811-8d41-507270d0b9c7
Red Canary NETWIRE January 2020ATTACK:enterprise:S1016 → uses → ATTACK:enterprise:T1573
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--f04dbb1e-bf75-4eee-9222-374c704bc07b
ESET DazzleSpy Jan 2022ATTACK:enterprise:S0367 → uses → ATTACK:enterprise:T1573
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--f18b11ea-4604-4c9e-8f12-6cfb526ef58c
Fortinet Emotet May 2017