Detect Asymmetric Cryptography in CrowdStrike LogScale
Adversaries may employ asymmetric encryption algorithms such as RSA, ECDH, or Diffie-Hellman to conceal command and control (C2) traffic. Asymmetric cryptography uses a keypair: a public key for encryption and a private key for decryption, ensuring only the intended recipient can read the data. In practice, most C2 frameworks (Cobalt Strike, Sliver, Havoc, AsyncRAT, Metasploit) use TLS for all communications, leveraging asymmetric cryptography for key exchange before switching to symmetric encryption for the bulk session data. Real-world malware families using this technique include SombRAT (SSL-encrypted C2), LunarWeb (RSA-4096 encrypted commands), SodaMaster (hardcoded RSA key for C2 traffic), ComRAT (RSA+AES for Gmail C2 channel), and Cyclops Blink (OpenSSL RSA public key encrypting per-message keys under TLS). Detection must focus on behavioral indicators: LOLBin processes initiating TLS connections, self-signed or anomalous certificate attributes, TLS on non-standard ports, regular beaconing intervals from non-browser processes, and use of cryptographic tools (openssl, certutil, .NET RSA APIs) in unexpected contexts.
MITRE ATT&CK
- Tactic
- Command and Control
- Technique
- T1573 Encrypted Channel
- Sub-technique
- T1573.002 Asymmetric Cryptography
- Canonical reference
- https://attack.mitre.org/techniques/T1573/002/
LogScale Detection Query
// Approach 1: LOLBin processes making outbound connections to public IPs (Falcon NetworkConnectIP4)
#event_simpleName=NetworkConnectIP4
| FileName IN ("cmd.exe", "powershell.exe", "pwsh.exe", "wscript.exe", "cscript.exe",
"mshta.exe", "regsvr32.exe", "rundll32.exe", "msbuild.exe", "csc.exe",
"installutil.exe", "regasm.exe", "wmic.exe", "bitsadmin.exe", "certutil.exe")
| !cidr(RemoteAddressIP4, "10.0.0.0/8")
| !cidr(RemoteAddressIP4, "172.16.0.0/12")
| !cidr(RemoteAddressIP4, "192.168.0.0/16")
| !cidr(RemoteAddressIP4, "127.0.0.0/8")
| !cidr(RemoteAddressIP4, "169.254.0.0/16")
| ConnectionFlags != "1" // exclude established/listen-only
| IsTLSPort := RemotePort IN (443, 8443, 4443, 8080, 8888, 8081, 9443, 2083, 2087, 2096)
| IsHighPort := if(RemotePort > 1024 AND NOT IsTLSPort, true(), false())
| SuspicionScore := case {
IsHighPort == true: 2;
IsTLSPort == true: 1;
default: 0
}
| SuspicionScore > 0
| groupBy(
[ComputerName, UserName, FileName, CommandLine, ParentBaseFileName, RemoteAddressIP4, RemotePort, IsTLSPort, IsHighPort, SuspicionScore],
function=count(aid, as=EventCount)
)
| sort(SuspicionScore, order=desc)
// Approach 2: Cryptographic tool / API invocations (Falcon ProcessRollup2)
// Run as a separate query and correlate:
// #event_simpleName=ProcessRollup2
// | FileName = "openssl.exe"
// OR CommandLine = /openssl (genrsa|genpkey|req|s_client|s_server)/i
// OR CommandLine = /RSACryptoServiceProvider|RSACng|RSAParameters|ECDiffieHellman/i
// OR CommandLine = /New-SelfSignedCertificate|makecert|Export-PfxCertificate|Import-PfxCertificate/i
// OR (FileName = "certutil.exe" AND CommandLine = /(-exportpfx|-importpfx|-MergePFX)/i)
// | CryptoSuspicion := case {
// CommandLine = /openssl genrsa|openssl genpkey|RSACryptoServiceProvider|RSACng|ECDiffieHellman|New-SelfSignedCertificate/i: 2;
// CommandLine = /openssl req|openssl s_client|Export-PfxCertificate|Import-PfxCertificate|-exportpfx|-importpfx/i: 1;
// default: 0
// }
// | CryptoSuspicion > 0
// | groupBy([ComputerName, UserName, FileName, CommandLine, ParentBaseFileName, CryptoSuspicion], function=count(aid, as=EventCount))
// | sort(CryptoSuspicion, order=desc)CrowdStrike LogScale (CQL) query detecting T1573.002 asymmetric cryptography C2 via two Falcon sensor event types. Approach 1 uses NetworkConnectIP4 events to identify LOLBin and scripting engine processes (cmd, PowerShell, wscript, mshta, regsvr32, rundll32, msbuild, certutil, etc.) connecting to non-RFC1918 public IP addresses on TLS or high non-standard ports, scored by connection type. Approach 2 (provided as comment) uses ProcessRollup2 events to detect cryptographic tool invocations including openssl key generation, .NET RSA/ECDH class usage, and certutil certificate operations. Group-by aggregation reduces noise from repeated beaconing.
Data Sources
Required Tables
False Positives & Tuning
- Endpoint management agents and software updaters (Falcon sensor updates, OS patch tooling) that use bitsadmin.exe or certutil.exe to download signed packages from CDN endpoints over HTTPS
- Legitimate scripted automation running PowerShell on server endpoints that makes regular TLS calls to monitoring APIs, ticketing systems (ServiceNow, PagerDuty), or cloud management planes
- Development and build workstations where csc.exe, msbuild.exe, or installutil.exe are invoked by IDE toolchains communicating with artifact repositories or license servers over non-standard TLS ports
Other platforms for T1573.002
Testing Methodology
Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1RSA Key Pair Generation via OpenSSL Command Line
Expected signal: Sysmon Event ID 1 (Process Create): openssl.exe with CommandLine containing 'genrsa -out' and 'rsa -in ... -pubout'. Sysmon Event ID 11 (File Create): df00tech_test_priv.pem and df00tech_test_pub.pem created in %TEMP%. Security Event ID 4688 if process command line auditing is enabled via GPO.
- Test 2In-Memory RSA Encryption via PowerShell .NET API
Expected signal: Sysmon Event ID 1 (Process Create): powershell.exe with CommandLine containing 'RSACryptoServiceProvider'. PowerShell ScriptBlock Log Event ID 4104 (Microsoft-Windows-PowerShell/Operational) capturing the full RSA key generation and encrypt/decrypt code in plaintext. No network connections expected — this test exercises the crypto API only.
- Test 3Outbound TLS Handshake from LOLBin Process Chain (cmd.exe -> PowerShell)
Expected signal: Sysmon Event ID 1 (Process Create): cmd.exe spawning powershell.exe — parent-child relationship captured. Sysmon Event ID 3 (Network Connection): powershell.exe connecting to 1.1.1.1:443. PowerShell ScriptBlock Log Event ID 4104 capturing the SslStream and AuthenticateAsClient code showing TLS setup. The cmd.exe → powershell.exe → external TLS connection chain is the key indicator.
- Test 4Self-Signed Certificate Generation for Adversary C2 Server
Expected signal: Sysmon Event ID 1 (Process Create): powershell.exe with CommandLine containing 'New-SelfSignedCertificate' and 'RSA'. Sysmon Event ID 11 (File Create): df00tech_c2cert.pfx in %TEMP%. Sysmon Event ID 12/13 (Registry Create/Set): certificate installation to Cert:\CurrentUser\My store captured as registry operations under HKCU\Software\Microsoft\SystemCertificates. PowerShell ScriptBlock Log Event ID 4104 with full certificate generation and export code.
References (14)
- https://attack.mitre.org/techniques/T1573/002/
- http://www.sans.org/reading-room/whitepapers/analyst/finding-hidden-threats-decrypting-ssl-34840
- https://insights.sei.cmu.edu/cert/2015/03/the-risks-of-ssl-inspection.html
- https://arxiv.org/ftp/arxiv/papers/1408/1408.1136.pdf
- https://engineering.salesforce.com/tls-fingerprinting-with-ja3-and-ja3s-247362855967/
- https://github.com/salesforce/ja3
- https://www.ncsc.gov.uk/files/Cyclops-Blink-Malware-Analysis-Report.pdf
- https://www.welivesecurity.com/2020/05/26/agentbtz-comratv4-ten-year-journey/
- https://securelist.com/apt10-sophisticated-multi-layered-loader-rosneft/101524/
- https://www.blackberry.com/us/en/solutions/endpoint-security/cylanceprotect/research/2020/costaricto
- https://learn.microsoft.com/en-us/dotnet/api/system.security.cryptography.rsacryptoserviceprovider
- https://learn.microsoft.com/en-us/dotnet/api/system.net.security.sslstream
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1573.002/T1573.002.md
- https://github.com/SigmaHQ/sigma/tree/master/rules/windows/network_connection
Unlock Pro Content
Get the full detection package for T1573.002 including response playbook, investigation guide, and atomic red team tests.