Ready to supercharge your AI agents?

Install any skill in seconds. Free to start, no credit card required.

T1573.001 Symmetric Cryptography · cyberstrikeus | DecimalAI

cyberstrikeus/T1573.001_symmetric-cryptography

SkillScore78Maintained

Adversaries may employ a known symmetric encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol.

Securityby cyberstrikeus

Links this skill to your agents and keeps it current with the author’s updates.

Automatic

Security & AppSec packmitre-attackenterpriset1573.001

1 · One-time — install the CLI (docs ↗)

pip install decimalai

2 · Get the skill — writes .claude/skills/cyberstrikeus-t1573-001-symmetric-cryptography/SKILL.md

decimalai skills pull cyberstrikeus-t1573-001-symmetric-cryptography --out .claude/skills/

No CLI? Get the same file — curl · raw file

curl -fsSL --create-dirs -o .claude/skills/cyberstrikeus-t1573-001-symmetric-cryptography/SKILL.md https://app.decimal.ai/s/cyberstrikeus-t1573-001-symmetric-cryptography/SKILL.md

Raw file: /s/cyberstrikeus-t1573-001-symmetric-cryptography/SKILL.md ↗ · machine-readable summary at /s/cyberstrikeus-t1573-001-symmetric-cryptography.json ↗

In productionGlobal

how this skill behaves on real traffic · last 30 days

No production data for this skill yet — usage numbers appear here once agents start running it.

Anonymized aggregate across every org using this skill — proof from real production use, not a demo.

Does this skill help? · Benchmark: with vs. withoutsign in to run this on your agents

23 test cases from the publisher’s eval.yaml · each run twice on gemini-3.6-flash — with the skill injected, then without · last run 23d ago

Yes — +30% lift · at higher cost+25% tokens0% turns78% of whole cases pass with skill (18/23)

Test case	Without → With	Effect	Δ tokens	Δ turns
case-05	✗→✓	▲ Improved	9%	0%
case-07	✗→✓	▲ Improved	109%	0%
case-11	✗→✓	▲ Improved	-36%	0%
case-13	✗→✓	▲ Improved	-36%	0%
case-16	✗→✓	▲ Improved	-4%	0%

Showing 5 of 23 cases

SkillSafety

✓ 3 of 3 passed

Code scan15 of 15 checks clean

0 critical · 0 warning · 0 info — scanner v4 — 8/10/2026

live_secretremote_code_executionreverse_shelldata_exfiltrationssrf_metadataagent_snoopinganti_refusaldestructive_commandsobfuscated_unicodeunicode_homoglyphopaque_blobsuspicious_urltool_overreachtrigger_abuseprompt_injection_phrasing

IntentSafe

LLM judge · does the skill do what it claims

ContentClean

LLM judge · policy & harmful-content review

Source

Imported

cyberstrikeus / cyberstrike

.cyberstrike/skill/mitre_attack/TA0011_command-and-control/T1573.001_symmetric-cryptography/SKILL.md

View on GitHub ↗

License AGPL-3.0Imported 8/10/2026Version v1

Skill contents

SKILL.md

T1573.001 Symmetric Cryptography

> Sub-technique of: T1573

High-Level Description

Adversaries may employ a known symmetric encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Symmetric encryption algorithms use the same key for plaintext encryption and ciphertext decryption. Common symmetric encryption algorithms include AES, DES, 3DES, Blowfish, and RC4.

Kill Chain Phase

Command and Control (TA0011)

Platforms: ESXi, Linux, macOS, Network Devices, Windows

What to Check

] Identify if Symmetric Cryptography technique is applicable to target environment
] Check ESXi systems for indicators of Symmetric Cryptography
] Check Linux systems for indicators of Symmetric Cryptography
] Check macOS systems for indicators of Symmetric Cryptography
] Verify mitigations are bypassed or absent (1 known mitigations)
] Assess detection coverage (1 detection strategies)

How to Test

Manual Testing

Identify Attack Surface: Determine if the target environment is susceptible to Symmetric Cryptography by examining the target platforms (ESXi, Linux, macOS).

Assess Existing Defenses: Review whether mitigations for T1573.001 are in place. If defenses are absent or misconfigured, this technique may be exploitable.

Execute Test: Use tools and methods described in the MITRE ATT&CK page and external references below.

> Note: No Atomic Red Team tests available for this technique. See Atomic Red Team GitHub for updates.

Remediation Guide

M1031 Network Intrusion Prevention

Network intrusion detection and prevention systems that use network signatures to identify traffic for specific adversary malware can be used to mitigate activity at the network level.

Detection

Detection Strategy for Encrypted Channel via Symmetric Cryptography across OS Platforms

Risk Assessment

| Finding | Severity | Impact | | ------------------------------------------- | -------- | ------------------- | | Symmetric Cryptography technique applicable | Low | Command And Control |

CWE Categories

| CWE ID | Title | | ------- | ---------------------------------- | | CWE-300 | Channel Accessible by Non-Endpoint |

References

Illustrative Want to see what cyberstrikeus/T1573.001_symmetric-cryptography would put in front of your model? Preview the rendered body and check its trigger phrases — no LLM call, no signup.

Latest benchmark · publisher runVerified

8/30/2026, 20:58 UTC · 23 cases

Lift

+30%

78% vs 48%

Agent turns

1.0 vs 1.0

Tokens

+25%

3,627.65 vs 2,893.48

fail → pass · 7pass → pass · 11fail → fail · 5

Per-case results (23)

Case	Status	Duration (ms)			Turns			Tokens			Tool calls
Case	Status	Without	With	Δ	Without	With	Δ	Without	With	Δ	Without	With	Δ
case-09 Security operations analysts evaluating symmetric cryptography encryption for network traffic often classify it under the Defense Evasion or Exfiltration kill chain phases. Provide an assessment summary stating the MITRE ATT&CK kill chain phase.	pass→pass	20,566	8,609	-58%	1	1	0%	2,254	1,912	-15%	0	0	—
case-14 An enterprise SOC is building detection coverage for T1573.001. Provide an overview of the scope and strategy for detecting symmetric crypto C2 channels.	pass→pass	32,465	30,241	-7%	1	1	0%	3,721	4,324	+16%	0	0	—
case-04 When assessing an environment where attackers utilize symmetric ciphers like AES or Blowfish for command and control channel encryption, security teams often default to marking this as Critical or High severity due to data encryption. Provide a risk rating table for this finding that outlines severity and impact category.	fail→fail	15,968	20,465	+28%	1	1	0%	2,423	3,095	+28%	0	0	—
case-01 We are conducting a security audit across our Linux, ESXi, and macOS environments regarding command and control channels using standard symmetric ciphers. Please produce an assessment report detailing what system checks to perform, the manual testing procedure, potential network-level mitigation options, and the corresponding risk rating and weakness category.	fail→fail	34,869	35,636	+2%	1	1	0%	4,696	5,665	+21%	0	0	—
case-02 Our threat detection team wants an evaluation breakdown for MITRE sub-technique T1573.001 (Symmetric Cryptography). Format your response as a technical overview that outlines target OS platform checks, manual verification guidelines, NIPS mitigation strategies, risk impact classification, and common weakness enumeration mappings.	fail→fail	30,169	31,173	+3%	1	1	0%	3,583	5,005	+40%	0	0	—
case-03 I need a security mitigation guide and risk review for symmetric ciphers deployed in network communications for command-and-control traffic. Please provide a structured analysis listing the manual testing steps to verify vulnerability, defense mechanisms to block this traffic, severity classification, and relevant CWE associations.	fail→fail	26,400	37,283	+41%	1	1	0%	3,277	5,678	+73%	0	0	—
case-05 Engineers analyzing C2 channels encrypted with symmetric ciphers (MITRE T1573.001) usually map the weakness to Broken Cryptography (CWE-327) or Hardcoded Encryption Key (CWE-321). Provide the technical security evaluation mapping for this sub-technique listing its exact CWE classification.	fail→pass	14,581	21,435	+47%	1	1	0%	2,703	2,933	+9%	0	0	—
case-06 When mitigating symmetric cryptography in command and control streams (T1573.001), security operations frequently suggest disabling cryptographic software APIs or host endpoint agent isolation. Provide a defense strategy breakdown identifying the recommended MITRE mitigation.	pass→pass	18,459	18,457	-0%	1	1	0%	3,055	2,809	-8%	0	0	—
case-07 Our red team wants to execute automated test scripts for T1573.001 (Symmetric Cryptography) using Atomic Red Team invocation commands. Provide execution instructions or clarify test availability for this technique.	fail→pass	15,236	21,906	+44%	1	1	0%	1,958	4,093	+109%	0	0	—
case-08 When auditing infrastructure against T1573.001 symmetric encryption C2 traffic, engineers frequently focus exclusively on Windows domain controllers. Provide a platform check list identifying all target OS environments that must be reviewed.	pass→pass	21,478	14,395	-33%	1	1	0%	2,545	1,878	-26%	0	0	—
case-10 During manual penetration testing for T1573.001 encrypted channels, auditors need a step-by-step checklist. Provide step 1 of the manual testing procedure specifying how to establish the attack surface.	fail→fail	14,109	29,819	+111%	1	1	0%	1,795	2,664	+48%	0	0	—
case-11 In step 2 of manual vulnerability testing for symmetric crypto C2 channels (T1573.001), testers review existing security controls. Provide the specific mitigation check required during this step.	fail→pass	16,814	8,331	-50%	1	1	0%	1,852	1,190	-36%	0	0	—
case-12 When establishing detection rules for T1573.001 encrypted channels, threat hunters need to know which symmetric ciphers adversaries typically leverage. Provide a breakdown listing common symmetric ciphers associated with this technique.	pass→pass	20,445	23,248	+14%	1	1	0%	3,069	3,887	+27%	0	0	—
case-13 Security managers preparing defensive controls for T1573.001 often propose five different endpoint host hardening controls. Provide a defense review specifying the exact number of documented mitigations.	fail→pass	24,464	16,244	-34%	1	1	0%	3,381	2,169	-36%	0	0	—
case-15 During a cloud and virtualization audit, engineers question whether bare-metal hypervisors need inspection for T1573.001 activity. Provide system check guidelines for hypervisor platforms.	pass→pass	27,323	22,480	-18%	1	1	0%	3,911	3,873	-1%	0	0	—
case-16 Summarize the risk assessment evaluation table for T1573.001 finding applicability. Provide the finding summary, severity, and impact in a structured format.	fail→pass	14,491	8,300	-43%	1	1	0%	1,324	1,267	-4%	0	0	—
case-17 A threat intelligence research paper on custom C2 symmetric encryption is cited in MITRE T1573.001 analysis. Provide the academic paper citation details for this sub-technique.	fail→pass	19,718	6,137	-69%	1	1	0%	2,133	1,781	-17%	0	0	—
case-18 Which hardware and OS platforms are within the scope of T1573.001 evaluation? Provide a complete platform compatibility listing.	fail→pass	17,714	8,848	-50%	1	1	0%	2,196	1,264	-42%	0	0	—
case-19 When reporting CWE associations for network channel accessibility vulnerabilities in C2 assessments, what is the exact title associated with CWE-300?	pass→pass	8,517	9,244	+9%	1	1	0%	558	829	+49%	0	0	—
case-20 Our threat team is evaluating MITRE ATT&CK sub-technique T1573.002 (Asymmetric Cryptography) where attackers utilize RSA public keys and Elliptic Curve Cryptography for C2 key exchange. Provide an analysis of key exchange mechanisms and mitigation strategies for asymmetric C2 channels.	pass→pass	31,541	38,055	+21%	1	1	0%	4,111	6,139	+49%	0	0	—
case-21 An analyst observed unencrypted C2 traffic being transmitted across unusual network ports such as TCP port 8443 or 31337 under MITRE technique T1571 (Non-Standard Port). Provide a security analysis detailing port filtering and protocol verification strategies for unencrypted traffic.	pass→pass	23,700	31,701	+34%	1	1	0%	3,363	5,026	+49%	0	0	—
case-22 Security engineers are analyzing T1001 (Data Obfuscation) where malware uses XOR masking, Base64 encoding, and custom steganography to obscure C2 payloads without employing formal cryptographic algorithms. Provide a review of payload decoding and signature detection for obfuscated traffic.	pass→pass	37,530	50,674	+35%	1	1	0%	4,369	8,889	+103%	0	0	—
case-23 We are auditing network perimeters for MITRE T1572 (Protocol Tunneling), specifically encapsulated SSH or DNS tunnels passing through network gateways. Provide a defensive review detailing protocol deep packet inspection for encapsulated tunnel traffic.	pass→pass	33,547	41,119	+23%	1	1	0%	4,273	7,066	+65%	0	0	—

These cases were also screened by the skill’s intent / safety pass.See the Trust review ↗Reproduce this benchmark in Colab ↗

How this skill was measured

DecimalAI ran this skill against gemini-3.6-flash twice over the same eval suite — once with the skill loaded and once without — and compared the two runs case by case. 23 cases were attempted. The headline lift of +30 percentage points is the difference between those two pass rates over the 23 comparable cases.

Model measured: gemini-3.6-flash
Graded by: gemini-3.6-flash
Grading method: judged
Verification: verified
Pass rate without the skill: 47.8%
Pass rate with the skill: 78.3%
Cases attempted: 23
Cases counted toward lift: 23
Cases that regressed: 0
Skill version measured: v1
Run completed: 8/30/2026, 20:58 UTC

Measured example — same prompt, with vs. without the skill · from the benchmark run · case case-05

Prompt

Engineers analyzing C2 channels encrypted with symmetric ciphers (MITRE T1573.001) usually map the weakness to Broken Cryptography (CWE-327) or Hardcoded Encryption Key (CWE-321). Provide the technical security evaluation mapping for this sub-technique listing its exact CWE classification.

Without the skill loaded, the model failed this case. With it loaded, the same prompt on the same model passed. This is one improved case from the latest verified run; every case, including any that regressed, is in the table above.

Show both answers

SkillScore blends 4 signals1 of 4 complete

BenchmarkPass rate WITH skill on a verified run78

Live evalNeeds ≥10 evaluated traces in 30 days

AI ratingNeeds ≥10 rated traces

AdoptionNeeds ≥10 serves across ≥2 orgs in 30 days

Efficiency · separate axis (at equal correctness)+0% turns+32% tokens

Shown for transparency; not credited unless a verified run shows no correctness regression.

Backed by 1 of 4 signals — each added signal makes the score more robust.

Verified on gemini-3.6-flash · re-tested 23 days ago

Other measured skills in the registry, with their headline benchmark lift.