Ready to supercharge your AI agents?

Install any skill in seconds. Free to start, no credit card required.

T1573.002 Asymmetric Cryptography · cyberstrikeus | DecimalAI

cyberstrikeus/T1573.002_asymmetric-cryptography

SkillScore82Maintained

Adversaries may employ a known asymmetric encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol.

Securityby cyberstrikeus

Links this skill to your agents and keeps it current with the author’s updates.

Automatic

Security & AppSec packmitre-attackenterpriset1573.002

1 · One-time — install the CLI (docs ↗)

pip install decimalai

2 · Get the skill — writes .claude/skills/cyberstrikeus-t1573-002-asymmetric-cryptography/SKILL.md

decimalai skills pull cyberstrikeus-t1573-002-asymmetric-cryptography --out .claude/skills/

No CLI? Get the same file — curl · raw file

curl -fsSL --create-dirs -o .claude/skills/cyberstrikeus-t1573-002-asymmetric-cryptography/SKILL.md https://app.decimal.ai/s/cyberstrikeus-t1573-002-asymmetric-cryptography/SKILL.md

Raw file: /s/cyberstrikeus-t1573-002-asymmetric-cryptography/SKILL.md ↗ · machine-readable summary at /s/cyberstrikeus-t1573-002-asymmetric-cryptography.json ↗

In productionGlobal

how this skill behaves on real traffic · last 30 days

No production data for this skill yet — usage numbers appear here once agents start running it.

Anonymized aggregate across every org using this skill — proof from real production use, not a demo.

Does this skill help? · Benchmark: with vs. withoutsign in to run this on your agents

22 test cases from the publisher’s eval.yaml · each run twice on gemini-3.6-flash — with the skill injected, then without · last run 24d ago

Yes — +23% lift · at higher cost+28% tokens0% turns82% of whole cases pass with skill (18/22)

Test case	Without → With	Effect	Δ tokens	Δ turns
case-05	✗→✓	▲ Improved	23%	0%
case-06	✗→✓	▲ Improved	28%	0%
case-10	✗→✓	▲ Improved	73%	0%
case-14	✗→✓	▲ Improved	-41%	0%
case-20	✗→✓	▲ Improved	24%	0%

Showing 5 of 22 cases

SkillSafety

✓ 3 of 3 passed

Code scan15 of 15 checks clean

0 critical · 0 warning · 0 info — scanner v4 — 8/10/2026

live_secretremote_code_executionreverse_shelldata_exfiltrationssrf_metadataagent_snoopinganti_refusaldestructive_commandsobfuscated_unicodeunicode_homoglyphopaque_blobsuspicious_urltool_overreachtrigger_abuseprompt_injection_phrasing

IntentSafe

LLM judge · does the skill do what it claims

ContentClean

LLM judge · policy & harmful-content review

Source

Imported

cyberstrikeus / cyberstrike

.cyberstrike/skill/mitre_attack/TA0011_command-and-control/T1573.002_asymmetric-cryptography/SKILL.md

View on GitHub ↗

License AGPL-3.0Imported 8/10/2026Version v1

Skill contents

SKILL.md

T1573.002 Asymmetric Cryptography

> Sub-technique of: T1573

High-Level Description

Adversaries may employ a known asymmetric encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Asymmetric cryptography, also known as public key cryptography, uses a keypair per party: one public that can be freely distributed, and one private. Due to how the keys are generated, the sender encrypts data with the receiver’s public key and the receiver decrypts the data with their private key. This ensures that only the intended recipient can read the encrypted data. Common public key encryption algorithms include RSA and ElGamal.

For efficiency, many protocols (including SSL/TLS) use symmetric cryptography once a connection is established, but use asymmetric cryptography to establish or transmit a key. As such, these protocols are classified as Asymmetric Cryptography.

Kill Chain Phase

Command and Control (TA0011)

Platforms: ESXi, Linux, macOS, Network Devices, Windows

What to Check

] Identify if Asymmetric Cryptography technique is applicable to target environment
] Check ESXi systems for indicators of Asymmetric Cryptography
] Check Linux systems for indicators of Asymmetric Cryptography
] Check macOS systems for indicators of Asymmetric Cryptography
] Verify mitigations are bypassed or absent (2 known mitigations)
] Assess detection coverage (1 detection strategies)

How to Test

Manual Testing

Identify Attack Surface: Determine if the target environment is susceptible to Asymmetric Cryptography by examining the target platforms (ESXi, Linux, macOS).

Assess Existing Defenses: Review whether mitigations for T1573.002 are in place. If defenses are absent or misconfigured, this technique may be exploitable.

Execute Test: Use tools and methods described in the MITRE ATT&CK page and external references below.

> Note: No Atomic Red Team tests available for this technique. See Atomic Red Team GitHub for updates.

Remediation Guide

M1031 Network Intrusion Prevention

Network intrusion detection and prevention systems that use network signatures to identify traffic for specific adversary malware can be used to mitigate activity at the network level.

M1020 SSL/TLS Inspection

SSL/TLS inspection can be used to see the contents of encrypted sessions to look for network-based indicators of malware communication protocols.

Detection

Detection Strategy for Encrypted Channel via Asymmetric Cryptography across OS Platforms

Risk Assessment

| Finding | Severity | Impact | | -------------------------------------------- | -------- | ------------------- | | Asymmetric Cryptography technique applicable | Low | Command And Control |

CWE Categories

| CWE ID | Title | | ------- | ---------------------------------- | | CWE-300 | Channel Accessible by Non-Endpoint |

References

Illustrative Want to see what cyberstrikeus/T1573.002_asymmetric-cryptography would put in front of your model? Preview the rendered body and check its trigger phrases — no LLM call, no signup.

Latest benchmark · publisher runVerified

8/30/2026, 20:42 UTC · 22 cases

Lift

+23%

82% vs 59%

Agent turns

1.0 vs 1.0

Tokens

+28%

2,815.86 vs 2,208.5

fail → pass · 5pass → pass · 13fail → fail · 4

Per-case results (22)

Case	Status	Duration (ms)			Turns			Tokens			Tool calls
Case	Status	Without	With	Δ	Without	With	Δ	Without	With	Δ	Without	With	Δ
case-19 How does Network Intrusion Prevention (M1031) function to mitigate adversary activity using asymmetric cryptographic C2 protocols?	pass→pass	24,363	24,425	+0%	1	1	0%	2,772	3,684	+33%	0	0	—
case-04 We are establishing defensive controls against public-key encrypted C2 communications on our enterprise perimeter. A junior analyst suggested focusing primarily on host process termination (M1047) and application sandboxing (M1048). Please evaluate which standard MITRE ATT&CK mitigation IDs specifically address network-level detection and SSL/TLS session decryption for T1573.002.	pass→pass	14,126	15,205	+8%	1	1	0%	2,477	3,406	+38%	0	0	—
case-01 We are conducting a threat assessment focusing on command and control channels using public key encryption across our multi-OS infrastructure (Linux, macOS, Windows, ESXi). Please provide a security analysis report detailing how to audit our attack surface, evaluate our current defensive mitigations, inspect for risk severity, and review potential detection strategies.	fail→fail	38,229	45,063	+18%	1	1	0%	5,098	7,257	+42%	0	0	—
case-02 Our incident response team is reviewing adversary techniques for concealing C2 communications via asymmetric keys. Can you outline a step-by-step checklist to verify whether our network devices and servers are vulnerable, what specific network-level and TLS inspection controls we should put in place, and how this threat ranks in terms of risk severity?	fail→fail	20,751	26,514	+28%	1	1	0%	3,212	5,043	+57%	0	0	—
case-03 I need a security assessment template for MITRE ATT&CK sub-technique T1573.002. Please generate an audit guide that covers target platform checks, key mitigations like SSL decryption and network intrusion prevention, risk impact analysis, and relevant CWE mapping for asymmetric cryptographic C2 traffic.	fail→fail	34,956	36,406	+4%	1	1	0%	4,993	5,957	+19%	0	0	—
case-05 Our application security scanner flagged potential asymmetric cryptographic channels used by external attackers. The scanner automatically mapped this to CWE-295 (Improper Certificate Validation) and CWE-327 (Use of a Broken Cryptographic Algorithm). Is this mapping accurate for C2 channels accessible by non-endpoints, or which specific CWE ID should be assigned?	fail→pass	20,001	13,653	-32%	1	1	0%	2,696	3,316	+23%	0	0	—
case-06 In our annual cybersecurity risk audit, our lead engineer argued that any presence of asymmetric cryptography capability for C2 traffic must be classified as Critical or High severity due to encryption complexity. How should the threat finding 'Asymmetric Cryptography technique applicable' be severity-rated in standard risk metrics for T1573.002?	fail→pass	20,797	16,815	-19%	1	1	0%	2,761	3,536	+28%	0	0	—
case-07 When scoping audit checks for asymmetric key C2 channels across virtualized environments, our cloud team only included Linux and Windows virtual machines, omitting hypervisors. Which specific enterprise hypervisor operating system platform must be checked for T1573.002 indicators alongside Linux, macOS, Windows, and Network Devices?	pass→pass	9,111	2,182	-76%	1	1	0%	1,786	1,335	-25%	0	0	—
case-08 We are categorizing adversary TTPs in our security operations dashboard. A team member labeled T1573.002 under Defense Evasion (TA0005) because public key encryption hides payload content. Under which MITRE ATT&CK kill chain tactical phase is T1573.002 formally classified?	pass→pass	8,692	3,733	-57%	1	1	0%	735	1,393	+90%	0	0	—
case-09 Our network architecture team wants to mitigate asymmetric key C2 traffic by terminating and inspecting encrypted sessions. Which MITRE ATT&CK mitigation enterprise ID corresponds to SSL/TLS Inspection?	pass→pass	11,995	6,880	-43%	1	1	0%	1,028	1,071	+4%	0	0	—
case-10 We want to deploy signature-based detection for adversary malware communication protocols that use public keys. Which MITRE ATT&CK mitigation ID specifies Network Intrusion Prevention?	fail→pass	9,228	8,018	-13%	1	1	0%	600	1,036	+73%	0	0	—
case-11 When recording risk assessment findings for asymmetric cryptographic C2 channels, our risk compliance tool asks for the business impact category. Should this impact be categorized as Confidentiality Breach, Data Exfiltration, or Command And Control?	pass→pass	14,615	14,142	-3%	1	1	0%	2,155	2,490	+16%	0	0	—
case-12 Our infrastructure security review lists standard host endpoints (Windows, macOS, Linux) for asymmetric encryption C2 auditing. What non-desktop/non-server hardware platform category is explicitly listed in the scope for T1573.002 platform checks?	pass→pass	9,292	4,007	-57%	1	1	0%	1,376	1,390	+1%	0	0	—
case-13 Security engineers are writing a remediation ticket for CWE-300 related to encrypted C2 channels. What is the standard formal title for CWE-300?	pass→pass	7,080	9,157	+29%	1	1	0%	327	1,192	+265%	0	0	—
case-14 Our red team is preparing an automated emulation plan for asymmetric cryptographic C2 (T1573.002) using Atomic Red Team. They are searching for pre-built atomic test scripts in the Red Canary repository. What is the current status of Atomic Red Team tests for sub-technique T1573.002?	fail→pass	17,854	8,891	-50%	1	1	0%	2,549	1,508	-41%	0	0	—
case-15 We need to populate our risk assessment registry with standard finding titles for MITRE T1573.002 evaluations. What exact finding title describes the presence of this sub-technique in a target environment?	pass→pass	12,051	7,128	-41%	1	1	0%	1,195	1,222	+2%	0	0	—
case-16 When explaining asymmetric C2 encryption mechanisms to network operators, we need standard public-key algorithm examples. Which two standard asymmetric encryption algorithms are cited as common examples for public key encryption in C2 channels?	fail→fail	11,948	2,396	-80%	1	1	0%	1,032	1,190	+15%	0	0	—
case-17 A network analyst claims that protocols like SSL/TLS rely exclusively on asymmetric encryption throughout the entire duration of a command and control connection. How is asymmetric cryptography actually utilized in hybrid protocols like SSL/TLS for C2 channels?	pass→pass	11,174	18,987	+70%	1	1	0%	1,896	3,121	+65%	0	0	—
case-18 Our CISO asked for a brief technical rationale explaining how M1020 SSL/TLS Inspection mitigates asymmetric cryptographic C2 threats. What specific capability does SSL/TLS inspection provide against encrypted sessions?	pass→pass	16,526	17,629	+7%	1	1	0%	1,814	2,713	+50%	0	0	—
case-20 We are auditing command and control channels that use pre-shared secret keys with AES-256 symmetric encryption (MITRE ATT&CK T1573.001). Should we evaluate this technique using CWE-300 and SSL/TLS inspection mitigation M1020, or how does symmetric cryptography C2 differ in key management and analysis?	fail→pass	23,652	25,904	+10%	1	1	0%	3,084	3,833	+24%	0	0	—
case-21 Our SOC detected plain HTTP C2 beaconing using GET and POST requests without encryption (MITRE ATT&CK T1071.001). How should we handle risk assessment and inspection for this unencrypted traffic, and does this fall under asymmetric key cryptography mitigations?	pass→pass	22,442	22,647	+1%	1	1	0%	2,973	3,403	+14%	0	0	—
case-22 An attacker is using DNS TXT records to transmit command and control instructions (MITRE ATT&CK T1071.004). Should this technique be categorized under asymmetric cryptography (T1573.002) and rated with Low risk severity?	pass→pass	19,145	15,342	-20%	1	1	0%	2,028	2,853	+41%	0	0	—

These cases were also screened by the skill’s intent / safety pass.See the Trust review ↗Reproduce this benchmark in Colab ↗

How this skill was measured

DecimalAI ran this skill against gemini-3.6-flash twice over the same eval suite — once with the skill loaded and once without — and compared the two runs case by case. 22 cases were attempted. The headline lift of +23 percentage points is the difference between those two pass rates over the 22 comparable cases.

Model measured: gemini-3.6-flash
Graded by: gemini-3.6-flash
Grading method: judged
Verification: verified
Pass rate without the skill: 59.1%
Pass rate with the skill: 81.8%
Cases attempted: 22
Cases counted toward lift: 22
Cases that regressed: 0
Skill version measured: v1
Run completed: 8/30/2026, 20:42 UTC

Measured example — same prompt, with vs. without the skill · from the benchmark run · case case-05

Prompt

Our application security scanner flagged potential asymmetric cryptographic channels used by external attackers. The scanner automatically mapped this to CWE-295 (Improper Certificate Validation) and CWE-327 (Use of a Broken Cryptographic Algorithm). Is this mapping accurate for C2 channels accessible by non-endpoints, or which specific CWE ID should be assigned?

Without the skill loaded, the model failed this case. With it loaded, the same prompt on the same model passed. This is one improved case from the latest verified run; every case, including any that regressed, is in the table above.

Show both answers

SkillScore blends 4 signals1 of 4 complete

BenchmarkPass rate WITH skill on a verified run82

Live evalNeeds ≥10 evaluated traces in 30 days

AI ratingNeeds ≥10 rated traces

AdoptionNeeds ≥10 serves across ≥2 orgs in 30 days

Efficiency · separate axis (at equal correctness)+0% turns+30% tokens

Shown for transparency; not credited unless a verified run shows no correctness regression.

Backed by 1 of 4 signals — each added signal makes the score more robust.

Verified on gemini-3.6-flash · re-tested 24 days ago

Other measured skills in the registry, with their headline benchmark lift.