Sigma Watch is free and independent. If it saves you time, keep it running. ☕ Buy me a coffee
SigmaWatch
ATT&CK technique

T1573

Encrypted Channel

Command and Control 47 detections found
View on MITRE ATT&CK →

Detection rules

Source Rule Status Updated
elastic Newly Observed IPSEC NAT Traversal Peer production 2026-09-22
elastic Openssl Client or Server Activity production 2026-09-18
elastic Connection to Commonly Abused Free SSL Certificate Providers production 2026-09-18
elastic Deprecated TLS Version or Weak Cipher Negotiated Externally production 2026-09-18
elastic Potential Self-Signed TLS Certificate Recently Issued on External Connection production 2026-09-18
elastic Default Cobalt Strike Team Server Certificate production 2026-09-18
splunk SSL Certificates with Punycode experimental 2026-05-13
splunk Zeek x509 Certificate with Punycode experimental 2026-05-13
suricata ET MALWARE MakinoLoader CnC Checkin Attempt rev 1 2026-04-21
snort ET TROJAN MakinoLoader Tasking Request rev 1 2026-04-21
snort ET TROJAN MakinoLoader CnC Checkin Attempt rev 1 2026-04-21
suricata ET MALWARE MakinoLoader Tasking Request rev 1 2026-04-21
elastic Deprecated - Potential Non-Standard Port HTTP/HTTPS connection deprecated 2026-02-04
snort ET TROJAN LeakyStealer CnC Checkin rev 1 2025-11-07
suricata ET MALWARE LeakyStealer CnC Checkin rev 1 2025-11-07
suricata ET MALWARE Observed Malicious SSL Cert Associated with PolarEdge Botnet M2 rev 2 2025-07-24
suricata ET MALWARE Observed Malicious SSL Cert Associated with PolarEdge Botnet M1 rev 2 2025-07-24
suricata ET MALWARE Observed Malicious SSL Cert Associated with PolarEdge Botnet M3 rev 2 2025-07-24
suricata ET MALWARE Observed Malicious SSL Cert Associated with PolarEdge Botnet M4 rev 2 2025-07-24
snort ET TROJAN Observed Malicious SSL Cert Associated with PolarEdge Botnet M2 rev 2 2025-07-24
snort ET TROJAN Observed Malicious SSL Cert Associated with PolarEdge Botnet M1 rev 2 2025-07-24
snort ET TROJAN Observed Malicious SSL Cert Associated with PolarEdge Botnet M3 rev 2 2025-07-24
snort ET TROJAN Observed Malicious SSL Cert Associated with PolarEdge Botnet M4 rev 2 2025-07-24
snort ET TROJAN PolarEdge CnC Checkin rev 1 2025-02-28
snort ET INFO Default PolarSSL/mbedTLS Certificate Issuer Observed in Certificate M1 rev 1 2025-02-28
suricata ET INFO Default PolarSSL/mbedTLS Certificate Issuer Observed in Certificate M1 rev 1 2025-02-28
suricata ET MALWARE PolarEdge CnC Checkin rev 1 2025-02-28
sigma Kalambur Backdoor Curl TOR SOCKS Proxy Execution experimental 2025-02-11
suricata ET MALWARE Telemiris CnC Checkin rev 1 2025-01-06
snort ET TROJAN Telemiris CnC Checkin rev 1 2025-01-06
snort ET TROJAN ShadowROOT RAT Malicious SSL Cert Serial Observed M1 rev 1 2025-01-06
snort ET TROJAN ShadowROOT RAT Malicious SSL Cert Serial Observed M2 rev 1 2025-01-06
suricata ET MALWARE ShadowROOT RAT Malicious SSL Cert Serial Observed M2 rev 1 2025-01-06
suricata ET MALWARE ShadowROOT RAT Malicious SSL Cert Serial Observed M1 rev 1 2025-01-06
snort ET TROJAN Xenorat Default C2 Server Response Inbound rev 1 2024-12-19
suricata ET MALWARE Xenorat Default C2 Server Response Inbound rev 1 2024-12-19
suricata ET MALWARE Xenorat Default Handshake Inbound rev 1 2024-12-19
snort ET TROJAN Xenorat Default Handshake Inbound rev 1 2024-12-19
sigma Potential Pikabot C2 Activity test 2024-01-26
sigma Activity from Anonymous IP Addresses test 2022-10-09
sigma Activity from Suspicious IP Addresses test 2022-10-09
sigma Activity from Infrequent Country test 2022-10-09
suricata ET MALWARE Ave Maria/Warzone RAT Credential Exfil rev 1 2022-08-03
snort ET TROJAN Ave Maria/Warzone RAT Credential Exfil rev 1 2022-08-03
suricata ET MALWARE Ave Maria/Warzone RAT Encrypted CnC Checkin rev 2 2022-03-07
snort ET TROJAN Ave Maria/Warzone RAT Encrypted CnC Checkin rev 2 2022-03-07
sigma Suspicious SSL Connection test 2022-01-23