M0920 SSL/TLS Inspection
Break and inspect SSL/TLS sessions to look at encrypted web traffic for adversary activity.
|Created||06 June 2019|
|Last Modified||24 October 2022|
|Navigation Layer||View In ATT&CK® Navigator|
Techniques Addressed by Mitigation
|ics||T0884||Connection Proxy||If it is possible to inspect HTTPS traffic, the captures can be analyzed for connections that appear to be domain fronting.|