T1079
T1079

T1079 - Multilayer Encryption

Type: attack-pattern

An adversary performs C2 communications using multiple layers of encryption, typically (but not exclusively) tunneling a custom encryption scheme within a protocol encryption scheme such as HTTPS or SMTPS.