Skip to content

M0920 SSL/TLS Inspection

Break and inspect SSL/TLS sessions to look at encrypted web traffic for adversary activity.

Item Value
ID M0920
Version 1.0
Created 06 June 2019
Last Modified 24 October 2022
Navigation Layer View In ATT&CK® Navigator

Techniques Addressed by Mitigation

Domain ID Name Use
ics T0884 Connection Proxy If it is possible to inspect HTTPS traffic, the captures can be analyzed for connections that appear to be domain fronting.