T1573 IBM QRadar · QRadar

Detect Encrypted Channel in IBM QRadar

This detection identifies adversaries using custom or non-standard encryption to conceal command and control (C2) traffic. Unlike legitimate TLS/HTTPS, malware implementing encrypted channels often exhibits behavioral anomalies: unusual processes making encrypted connections, connections to raw IP addresses without SNI, self-signed or short-lived certificates, high-frequency beaconing intervals, non-browser processes using port 443/8443 with atypical TLS fingerprints (JA3), and data volumes inconsistent with the application type. This detection correlates process lineage, network destinations, certificate characteristics, and traffic timing to surface encrypted C2 channels used by threat actors such as Tropic Trooper, Lazarus Group, and malware families including RCSession, Cryptoistic, Gomir, and Chaes.

MITRE ATT&CK

Tactic
Command and Control
Technique
T1573 Encrypted Channel
Canonical reference
https://attack.mitre.org/techniques/T1573/

QRadar Detection Query

IBM QRadar (QRadar)
sql 
SELECT
  DATEFORMAT(devicetime,'yyyy-MM-dd HH:mm:ss') AS EventTime,
  sourceip, destinationip, destinationport,
  "Application" AS ProcessName,
  CASE
    WHEN "Application" IN ('chrome.exe','firefox.exe','msedge.exe','outlook.exe','teams.exe') THEN 'Legitimate Browser'
    WHEN destinationport IN (443,8443,4443) AND "Application" NOT IN ('chrome.exe','firefox.exe','msedge.exe') THEN 'Suspicious Encrypted Channel'
    ELSE 'Review Required'
  END AS RiskCategory,
  CASE
    WHEN destinationport IN (443,8443,4443) AND "Application" NOT IN ('chrome.exe','firefox.exe','msedge.exe') THEN 80
    WHEN destinationport IN (8080,9443,3443) THEN 60
    ELSE 40
  END AS RiskScore
FROM events
WHERE destinationport IN (443, 8443, 4443, 8080, 9443, 3443, 7443)
  AND NOT sourceip INCIDR '10.0.0.0/8'
  AND NOT sourceip INCIDR '172.16.0.0/12'
  AND NOT sourceip INCIDR '192.168.0.0/16'
  AND "Application" NOT IN ('chrome.exe','firefox.exe','msedge.exe','iexplore.exe','outlook.exe','teams.exe','onedrive.exe','slack.exe','zoom.exe')
  AND LOGSOURCETYPENAME(devicetype) ILIKE '%sysmon%'
LAST 1 HOURS
high severity medium confidence

QRadar AQL detection for Encrypted Channel. Detects encrypted C2 channels by identifying non-browser processes making encrypted connections (ports 443, 8443, etc.) to external IPs, particularly connections to raw IP addresses without hostname r

Data Sources

Sysmon via Windows Event LogNetwork flow data

Required Tables

events

False Positives & Tuning

  • Custom internal applications connecting to known infrastructure over HTTPS
  • IT management tools making regular encrypted check-ins
  • Security products (EDR agents) beaconing over encrypted channels
  • Cloud sync clients connecting to storage endpoints at regular intervals
  • VPN clients establishing persistent encrypted connections
Download portable Sigma rule (.yml)

Other platforms for T1573

Microsoft Sentinel (KQL) Splunk (SPL) Elastic Security (Elastic) Sumo Logic CSE (Sumo) Google Chronicle (YARA-L) CrowdStrike LogScale (LogScale) All platforms (combined) →

Testing Methodology

Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.

  1. Test 1Simulate Custom Encrypted C2 Beacon Using PowerShell SSL

    Expected signal: Sysmon Event ID 3 (NetworkConnect) with Image=powershell.exe, DestinationPort=443, DestinationHostname=ifconfig.me; Sysmon Event ID 1 showing PowerShell execution with -ExecutionPolicy Bypass flag; DeviceNetworkEvents showing 5 connections at ~30 second intervals (low jitter beaconing pattern)

  2. Test 2Simulate C2 Connection to Raw IP Address Over HTTPS

    Expected signal: Sysmon Event ID 3 with Image=powershell.exe, DestinationIp=1.1.1.1, DestinationPort=443, DestinationHostname empty or equal to the IP address; DeviceNetworkEvents showing IsIPOnlyConnection=true with RemoteUrl matching RemoteIP

  3. Test 3Simulate Encrypted C2 Beacon from LOLBin (mshta.exe)

    Expected signal: Sysmon Event ID 1 showing mshta.exe execution with HTA file path argument; Sysmon Event ID 3 with Image=mshta.exe, DestinationPort=443, DestinationHostname=httpbin.org; DeviceProcessEvents and DeviceNetworkEvents correlation showing mshta.exe as initiating process

  4. Test 4Linux Custom Encrypted Beacon Simulation Using OpenSSL

    Expected signal: Auditd SYSCALL records for connect() calls from openssl process; syslog entries showing openssl process network activity; on hosts with Sysmon for Linux, Event ID 3 showing openssl making TLS connections to external IP on port 443 at ~30 second intervals

Last updated: 2026-03-19 Research depth: deep
References (9)

Unlock Pro Content

Get the full detection package for T1573 including response playbook, investigation guide, and atomic red team tests.

Response PlaybookInvestigation GuideHunting QueriesAtomic Red Team TestsTuning Guidance
Sign Up for Pro View Pricing

Related Detections

Sub-techniques (2)

Related Techniques

T1573.001Symmetric CryptographyT1573.002Asymmetric CryptographyT1071Application Layer ProtocolT1132Data EncodingT1568Dynamic ResolutionT1219Remote Access ToolsT1205Traffic SignalingT1090ProxyT1059Command and Scripting Interpreter

Same Tactic: Command and Control

Popular Detections