Which SIEM platforms have a T1573.002 detection rule?

df00tech provides T1573.002 (Asymmetric Cryptography) detection queries for 7 SIEM platforms: Microsoft Sentinel / Defender, Splunk, Elastic Security (EQL), IBM QRadar (AQL), Sumo Logic CSE, Google Chronicle / SecOps, CrowdStrike LogScale (CQL).

What data sources are required to detect Asymmetric Cryptography (T1573.002)?

Detecting Asymmetric Cryptography requires the following data sources: Network Traffic: Network Connection Creation, Process: Process Creation, Command: Command Execution, Microsoft Defender for Endpoint.

What severity and confidence is the T1573.002 detection?

The T1573.002 detection is rated medium severity with medium confidence.

What are common false positives for T1573.002?

Common false positives for T1573.002 include: Legitimate PowerShell automation scripts (SCCM, Intune, Ansible WinRM) making HTTPS connections for patch management, configuration management, or telemetry reporting; Developer toolchains (npm, pip, cargo, dotnet restore) invoked from cmd.exe or PowerShell to fetch packages over TLS from public registries; PKI administrators or certificate automation scripts using openssl.exe, certutil.exe, or New-SelfSignedCertificate for legitimate certificate lifecycle management.

T1573.002 IBM QRadar · QRadar

Detect Asymmetric Cryptography in IBM QRadar

Adversaries may employ asymmetric encryption algorithms such as RSA, ECDH, or Diffie-Hellman to conceal command and control (C2) traffic. Asymmetric cryptography uses a keypair: a public key for encryption and a private key for decryption, ensuring only the intended recipient can read the data. In practice, most C2 frameworks (Cobalt Strike, Sliver, Havoc, AsyncRAT, Metasploit) use TLS for all communications, leveraging asymmetric cryptography for key exchange before switching to symmetric encryption for the bulk session data. Real-world malware families using this technique include SombRAT (SSL-encrypted C2), LunarWeb (RSA-4096 encrypted commands), SodaMaster (hardcoded RSA key for C2 traffic), ComRAT (RSA+AES for Gmail C2 channel), and Cyclops Blink (OpenSSL RSA public key encrypting per-message keys under TLS). Detection must focus on behavioral indicators: LOLBin processes initiating TLS connections, self-signed or anomalous certificate attributes, TLS on non-standard ports, regular beaconing intervals from non-browser processes, and use of cryptographic tools (openssl, certutil, .NET RSA APIs) in unexpected contexts.

MITRE ATT&CK

Tactic: Command and Control
Technique: T1573 Encrypted Channel
Sub-technique: T1573.002 Asymmetric Cryptography
Canonical reference: https://attack.mitre.org/techniques/T1573/002/

QRadar Detection Query

IBM QRadar (QRadar)

sql

SELECT
  DATEFORMAT(starttime, 'yyyy-MM-dd HH:mm:ss') AS EventTime,
  logsourcename(logsourceid) AS LogSource,
  sourceip AS SourceIP,
  destinationip AS DestinationIP,
  destinationport AS DestinationPort,
  username AS UserName,
  "ProcessName",
  "CommandLine",
  "ParentProcessName",
  CASE
    WHEN destinationport IN (443, 8443, 4443, 8080, 8888, 8081, 9443, 2083, 2087, 2096) THEN 'TLS_Standard_Port'
    WHEN LONG(destinationport) > 1024 THEN 'TLS_High_Port'
    ELSE 'Other'
  END AS ConnectionType,
  CASE
    WHEN "CommandLine" ILIKE '%openssl genrsa%' OR "CommandLine" ILIKE '%openssl genpkey%' OR "CommandLine" ILIKE '%RSACryptoServiceProvider%' OR "CommandLine" ILIKE '%RSACng%' OR "CommandLine" ILIKE '%ECDiffieHellman%' OR "CommandLine" ILIKE '%New-SelfSignedCertificate%' THEN 2
    WHEN LONG(destinationport) > 1024 AND destinationport NOT IN (443, 8443, 4443, 8080, 8888, 8081, 9443) THEN 2
    WHEN destinationport IN (443, 8443, 4443) THEN 1
    ELSE 0
  END AS SuspicionScore
FROM events
WHERE
  LOGSOURCETYPEID(logsourceid) IN (12, 13, 14)
  AND starttime > NOW() - 24 HOURS
  AND (
    -- Network connection events from suspicious processes (Sysmon Event ID 3)
    (
      eventid = 3
      AND (
        "ProcessName" ILIKE '%cmd.exe'
        OR "ProcessName" ILIKE '%powershell.exe'
        OR "ProcessName" ILIKE '%pwsh.exe'
        OR "ProcessName" ILIKE '%wscript.exe'
        OR "ProcessName" ILIKE '%cscript.exe'
        OR "ProcessName" ILIKE '%mshta.exe'
        OR "ProcessName" ILIKE '%regsvr32.exe'
        OR "ProcessName" ILIKE '%rundll32.exe'
        OR "ProcessName" ILIKE '%msbuild.exe'
        OR "ProcessName" ILIKE '%csc.exe'
        OR "ProcessName" ILIKE '%installutil.exe'
        OR "ProcessName" ILIKE '%regasm.exe'
        OR "ProcessName" ILIKE '%wmic.exe'
        OR "ProcessName" ILIKE '%bitsadmin.exe'
      )
      AND destinationip NOT ILIKE '10.%'
      AND destinationip NOT ILIKE '172.16.%' AND destinationip NOT ILIKE '172.17.%'
      AND destinationip NOT ILIKE '172.18.%' AND destinationip NOT ILIKE '172.19.%'
      AND destinationip NOT ILIKE '172.20.%' AND destinationip NOT ILIKE '172.31.%'
      AND destinationip NOT ILIKE '192.168.%'
      AND destinationip NOT ILIKE '127.%'
      AND destinationip NOT ILIKE '169.254.%'
    )
    OR
    -- Cryptographic tool / API invocation (Sysmon Event ID 1)
    (
      eventid = 1
      AND (
        "ProcessName" ILIKE '%openssl.exe'
        OR "CommandLine" ILIKE '%openssl genrsa%'
        OR "CommandLine" ILIKE '%openssl genpkey%'
        OR "CommandLine" ILIKE '%openssl req%'
        OR "CommandLine" ILIKE '%openssl s_client%'
        OR "CommandLine" ILIKE '%openssl s_server%'
        OR "CommandLine" ILIKE '%RSACryptoServiceProvider%'
        OR "CommandLine" ILIKE '%RSACng%'
        OR "CommandLine" ILIKE '%ECDiffieHellman%'
        OR "CommandLine" ILIKE '%RSAParameters%'
        OR "CommandLine" ILIKE '%New-SelfSignedCertificate%'
        OR "CommandLine" ILIKE '%makecert%'
        OR "CommandLine" ILIKE '%Export-PfxCertificate%'
        OR "CommandLine" ILIKE '%Import-PfxCertificate%'
        OR ("ProcessName" ILIKE '%certutil.exe' AND (
          "CommandLine" ILIKE '%-exportpfx%'
          OR "CommandLine" ILIKE '%-importpfx%'
          OR "CommandLine" ILIKE '%-MergePFX%'
        ))
      )
    )
  )
  AND SuspicionScore > 0
ORDER BY SuspicionScore DESC, starttime DESC

high severity medium confidence

QRadar AQL query detecting asymmetric cryptography C2 indicators from Windows Sysmon event logs. Identifies LOLBin and scripting engine processes (PowerShell, cmd, wscript, mshta, regsvr32, rundll32, etc.) making outbound non-RFC1918 TLS connections (EventID 3), as well as cryptographic tool invocations including openssl key generation, .NET RSA/ECDH API usage, and certutil certificate operations (EventID 1). Assigns a suspicion score to prioritize findings.

Data Sources

IBM QRadar SIEMMicrosoft Windows Sysmon (via QRadar DSM)Windows Security Event Logs

Required Tables

events

False Positives & Tuning

Software deployment systems executing msiexec or msbuild over HTTPS to internal or external package repositories as part of automated patch management
Helpdesk and IT administration tools (e.g., remote support agents, SCCM client) that use certutil to manage certificate stores during routine maintenance windows
Penetration testing or red team exercises on systems where such activity is expected and authorized — correlate with change management records

Download portable Sigma rule (.yml)

Other platforms for T1573.002

Microsoft Sentinel (KQL) Splunk (SPL) Elastic Security (Elastic) Sumo Logic CSE (Sumo) Google Chronicle (YARA-L) CrowdStrike LogScale (LogScale) All platforms (combined) →

Testing Methodology

Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.

Test 1RSA Key Pair Generation via OpenSSL Command Line
Expected signal: Sysmon Event ID 1 (Process Create): openssl.exe with CommandLine containing 'genrsa -out' and 'rsa -in ... -pubout'. Sysmon Event ID 11 (File Create): df00tech_test_priv.pem and df00tech_test_pub.pem created in %TEMP%. Security Event ID 4688 if process command line auditing is enabled via GPO.
Test 2In-Memory RSA Encryption via PowerShell .NET API
Expected signal: Sysmon Event ID 1 (Process Create): powershell.exe with CommandLine containing 'RSACryptoServiceProvider'. PowerShell ScriptBlock Log Event ID 4104 (Microsoft-Windows-PowerShell/Operational) capturing the full RSA key generation and encrypt/decrypt code in plaintext. No network connections expected — this test exercises the crypto API only.
Test 3Outbound TLS Handshake from LOLBin Process Chain (cmd.exe -> PowerShell)
Expected signal: Sysmon Event ID 1 (Process Create): cmd.exe spawning powershell.exe — parent-child relationship captured. Sysmon Event ID 3 (Network Connection): powershell.exe connecting to 1.1.1.1:443. PowerShell ScriptBlock Log Event ID 4104 capturing the SslStream and AuthenticateAsClient code showing TLS setup. The cmd.exe → powershell.exe → external TLS connection chain is the key indicator.
Test 4Self-Signed Certificate Generation for Adversary C2 Server
Expected signal: Sysmon Event ID 1 (Process Create): powershell.exe with CommandLine containing 'New-SelfSignedCertificate' and 'RSA'. Sysmon Event ID 11 (File Create): df00tech_c2cert.pfx in %TEMP%. Sysmon Event ID 12/13 (Registry Create/Set): certificate installation to Cert:\CurrentUser\My store captured as registry operations under HKCU\Software\Microsoft\SystemCertificates. PowerShell ScriptBlock Log Event ID 4104 with full certificate generation and export code.

Last updated: 2026-04-21 Research depth: deep

References (14)

Response Playbook

1. Examine the full command line and decode any Base64 content...
2. Identify the parent process chain and user context...
3. Check for concurrent network connections from the process...

Investigation Guide

Related techniques: T1027, T1105, T1562.001...
Forensic artifacts: PSReadLine history, Prefetch, ScriptBlock logs...

Atomic Red Team Tests

Test 1: Encoded command execution...
Test 2: Download cradle via Net.WebClient...

Unlock Pro Content

Get the full detection package for T1573.002 including response playbook, investigation guide, and atomic red team tests.

Response PlaybookInvestigation GuideHunting QueriesAtomic Red Team TestsTuning Guidance

Detect Asymmetric Cryptography in IBM QRadar

MITRE ATT&CK

QRadar Detection Query

Data Sources

Required Tables

False Positives & Tuning

Other platforms for T1573.002

Testing Methodology

Response Playbook

Investigation Guide

Atomic Red Team Tests

Unlock Pro Content

Related Detections

Parent Technique

Related Sub-techniques

Related Techniques

Same Tactic: Command and Control

Popular Detections

MITRE ATT&CK

QRadar Detection Query

Data Sources

Required Tables

False Positives & Tuning

Other platforms for T1573.002

Testing Methodology

Unlock Pro Content

Related Detections

Parent Technique

Related Sub-techniques

Related Techniques

Same Tactic: Command and Control

Popular Detections

Get new detections in your inbox