Which SIEM platforms have a T1600.002 detection rule?

df00tech provides T1600.002 (Disable Crypto Hardware) detection queries for 7 SIEM platforms: Microsoft Sentinel / Defender, Splunk, Elastic Security (EQL), IBM QRadar (AQL), Sumo Logic CSE, Google Chronicle / SecOps, CrowdStrike LogScale (CQL).

What data sources are required to detect Disable Crypto Hardware (T1600.002)?

Detecting Disable Crypto Hardware requires the following data sources: Network Device: Network Device Configuration, Network Device: Network Device Command, Cisco IOS Syslog (SYS, CRYPTO_ENGINE, PARSER facilities), CommonSecurityLog (CEF/LEEF from network device vendors).

What severity and confidence is the T1600.002 detection?

The T1600.002 detection is rated critical severity with medium confidence.

What are common false positives for T1600.002?

Common false positives for T1600.002 include: Scheduled network maintenance windows where administrators update crypto engine firmware or replace hardware security modules; Hardware accelerator failures triggering automatic software fallback — the CRYPTO_ENGINE-4-ACCEL_FAIL syslog message may fire during genuine hardware faults; Lab, staging, or development network devices where hardware crypto acceleration is intentionally disabled to reduce cost or simplify testing.

T1600.002 IBM QRadar · QRadar

Detect Disable Crypto Hardware in IBM QRadar

Adversaries disable a network device's dedicated hardware encryption accelerator, forcing the device to fall back to slower, software-based cryptographic operations. Hardware Security Modules (HSMs) and onboard crypto ASICs in routers, switches, and firewalls are purpose-built to perform encryption at line rate and resist tampering. Disabling them degrades cryptographic performance and may enable exploitation of weaker software cipher implementations. This technique is typically executed after gaining privileged access to network device management interfaces (via T1078.004, T1021.004, or T1601) and is most dangerous when combined with T1600.001 (Reduce Key Space) to both disable hardware protections and downgrade cipher strength, enabling adversaries to decrypt intercepted VPN or IPSec traffic.

MITRE ATT&CK

Tactic: Defense Evasion
Technique: T1600 Weaken Encryption
Sub-technique: T1600.002 Disable Crypto Hardware
Canonical reference: https://attack.mitre.org/techniques/T1600/002/

QRadar Detection Query

IBM QRadar (QRadar)

sql

SELECT UTF8(payload) as "Message", devicetime as "EventTime", sourceip as "SourceIP", hostname as "DeviceName", CASE WHEN UTF8(payload) ILIKE '%no crypto%' OR UTF8(payload) ILIKE '%null-encryption%' THEN 90 WHEN UTF8(payload) ILIKE '%encryption des%' OR UTF8(payload) ILIKE '%esp-des%' THEN 75 WHEN UTF8(payload) ILIKE '%modulus 512%' OR UTF8(payload) ILIKE '%group 1 %' THEN 65 ELSE 50 END as "RiskScore" FROM events WHERE LOGSOURCETYPENAME(devicetype) IN ('Cisco IOS', 'Juniper Networks Junos', 'Fortinet FortiGate') AND (UTF8(payload) ILIKE '%no crypto%' OR UTF8(payload) ILIKE '%encryption des%' OR UTF8(payload) ILIKE '%esp-des%' OR UTF8(payload) ILIKE '%modulus 512%' OR UTF8(payload) ILIKE '%modulus 768%' OR UTF8(payload) ILIKE '%group 1 %' OR UTF8(payload) ILIKE '%group 2 %' OR UTF8(payload) ILIKE '%null-encryption%' OR UTF8(payload) ILIKE '%ssl encryption rc4%' OR UTF8(payload) ILIKE '%ip ssh version 1%') ORDER BY "RiskScore" DESC LAST 24 HOURS

critical severity medium confidence

IBM QRadar AQL translation of the T1600.002 detection. Uses SQL-like syntax with risk scoring. Detects attempts to disable hardware cryptographic acceleration on network devices by monitoring sys

Data Sources

Network Device SyslogCisco IOSJuniper JunOS

Required Tables

events

False Positives & Tuning

Scheduled network maintenance windows where administrators update crypto engine firmware or replace hardware security modules
Hardware accelerator failures triggering automatic software fallback — the CRYPTO_ENGINE-4-ACCEL_FAIL syslog message may fire during genuine hardware faults
Lab, staging, or development network devices where hardware crypto acceleration is intentionally disabled to reduce cost or simplify testing
Vendor-initiated diagnostic procedures where TAC engineers disable hardware acceleration to isolate performance issues
Automated configuration management tools (Ansible, NAPALM, NSO) pushing approved baseline configurations that include software crypto fallback settings

Download portable Sigma rule (.yml)

Other platforms for T1600.002

Microsoft Sentinel (KQL) Splunk (SPL) Elastic Security (Elastic) Sumo Logic CSE (Sumo) Google Chronicle (YARA-L) CrowdStrike LogScale (LogScale) All platforms (combined) →

Testing Methodology

Validate this detection against 5 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.

Test 1Cisco IOS — Disable Hardware Crypto Accelerator via CLI
Expected signal: Cisco IOS syslog: PARSER-5-CFGLOG_LOGGEDCMD message containing 'no crypto engine accelerator' with the username and timestamp. SYS-5-CONFIG_I message indicating configuration was modified from the terminal. CRYPTO_ENGINE syslog facility messages indicating accelerator state change. TACACS+ command accounting record (if configured) with the exact command, user, and source IP.
Test 2Cisco IOS — Configure Software-Only Crypto Engine
Expected signal: Cisco IOS syslog: PARSER-5-CFGLOG_LOGGEDCMD with 'crypto engine software' command text. SYS-5-CONFIG_I indicating terminal configuration change. Running config inspection shows 'crypto engine software' statement present. TACACS+ accounting records the command with username attribution.
Test 3Cisco IOS — Simulate Hardware Accelerator Fault Leading to Software Fallback
Expected signal: Cisco IOS debug output forwarded as syslog: CRYPTO_ENGINE debug messages including accelerator state and statistics. The `show crypto engine accelerator statistics` output shows whether hardware or software is performing crypto operations — if software counters are incrementing while hardware counters remain static, hardware is disabled. Look for CRYPTO_ENGINE-4-ACCEL_FAIL or CRYPTO_ENGINE-6-KEY_DELETED messages in syslog if hardware fault is present.
Test 4Python — Audit Script to Detect Software Crypto Fallback via SNMP
Expected signal: SNMP query generates UDP traffic to port 161 on the target device. Network flow logs (NetFlow, IPFIX) record the SNMP polling connection. If the device has SNMP access logging enabled, a log entry records the SNMP GET request including the source IP and OID queried. cipSecGlobalHwAuthFails counter incrementing indicates the hardware crypto engine is failing to authenticate packets and falling back to software.
Test 5Juniper JunOS — Disable IPSec Hardware Offload
Expected signal: Juniper JUNOS syslog: UI_COMMIT_COMPLETED message indicating configuration was committed. UI_CMDLINE_READ_LINE messages logging individual configuration commands if command logging is enabled. Juniper RT_FLOW messages may show changed processing statistics post-commit. TACACS+ accounting records the configuration session if configured. The `show security ipsec statistics` output will show changes in hardware vs software packet processing counters.

Last updated: 2026-03-13 Research depth: deep

References (9)

Response Playbook

1. Examine the full command line and decode any Base64 content...
2. Identify the parent process chain and user context...
3. Check for concurrent network connections from the process...

Investigation Guide

Related techniques: T1027, T1105, T1562.001...
Forensic artifacts: PSReadLine history, Prefetch, ScriptBlock logs...

Atomic Red Team Tests

Test 1: Encoded command execution...
Test 2: Download cradle via Net.WebClient...

Unlock Pro Content

Get the full detection package for T1600.002 including response playbook, investigation guide, and atomic red team tests.

Response PlaybookInvestigation GuideHunting QueriesAtomic Red Team TestsTuning Guidance

Related Detections

Detect Disable Crypto Hardware in IBM QRadar

MITRE ATT&CK

QRadar Detection Query

Data Sources

Required Tables

False Positives & Tuning

Other platforms for T1600.002

Testing Methodology

Response Playbook

Investigation Guide

Atomic Red Team Tests

Unlock Pro Content

Related Detections

Parent Technique

Related Sub-techniques

Related Techniques

Same Tactic: Defense Evasion

Popular Detections

MITRE ATT&CK

QRadar Detection Query

Data Sources

Required Tables

False Positives & Tuning

Other platforms for T1600.002

Testing Methodology

Unlock Pro Content

Related Detections

Parent Technique

Related Sub-techniques

Related Techniques

Same Tactic: Defense Evasion

Popular Detections

Get new detections in your inbox