T1573 Encrypted Channel — Detection Rules

Source-backed rule directory

• Activity from Suspicious IP Addresses · test · medium · {"service":"threat_detection","product":"m365"}
• Activity from Anonymous IP Addresses · test · medium · {"service":"threat_management","product":"m365"}
• Activity from Infrequent Country · test · medium · {"service":"threat_management","product":"m365"}
• Suspicious SSL Connection · test · low · {"product":"windows","category":"ps_script","definition":"Requirements: Script Block Logging must be enabled"}

Atlas deterministic concepts

T1573 Encrypted Channel

MATCH(certificate_fingerprint OR tls_fingerprint IN denylist) OR MATCH(disallowed_tls_version_or_cipher) -> ALERT

• TLS and Certificate Metadata Logs
• Network Metadata Logs
• Atlas source section

Anomaly models

ATT&CK analytic guidance

DET0273 Detection Strategy for Encrypted Channel across OS Platforms

AN0759 Analytic 0759

Processes that normally do not initiate network connections establishing outbound encrypted TLS/SSL sessions, especially with asymmetric traffic volumes (client sending more than receiving) or non-standard certificate chains. Defender observations correlate process creation with unexpected network encryption libraries being loaded.

AN0760 Analytic 0760

Processes like curl, wget, python, socat, or custom binaries initiating TLS/SSL sessions to non-standard destinations. Defender sees abnormal syscalls for connect(), loading of libssl libraries, and persistent outbound encrypted traffic from daemons not normally communicating externally.

AN0761 Analytic 0761

Applications or launchd jobs initiating encrypted TLS traffic to rare external hosts. Defender observes unified logs showing ssl/TLS API calls by processes not baseline-approved, and payload entropy suggesting encrypted C2 sessions.

AN0762 Analytic 0762

VMware management daemons or guest processes initiating encrypted connections outside expected vCenter, update servers, or internal comms. Defender identifies hostd or vpxa initiating outbound TLS flows with uncommon destinations.

AN0763 Analytic 0763

Unusual TLS tunnels through ports not normally encrypted (e.g., TLS on port 8080, 53). Defender sees NetFlow/IPFIX or packet inspection indicating high-entropy traffic volumes and asymmetric client/server exchange ratios.