Techniques › T1205.001 › AN0843
AN0843 Analytic 0843
Linux · attack.mitre.org · ATT&CK Enterprise v19.2
<p>A source performs a short closed-port sequence; the host then modifies iptables/nftables/ufw rules or starts a daemon binding a new socket, followed by a successful connection from the same source.</p>
- Detects
- T1205.001 Port Knocking
- Part of
- DET0302 Port-knock → rule/daemon change → first successful connect (T1205.001)
Log sources and channels
Exactly as MITRE states them in x_mitre_log_source_references. Where a channel is vague, it is vague in the source; kevmap does not tidy it.
| Log source | Channel | Data component |
|---|---|---|
| auditd:SYSCALL | execve: Commands that alter firewall or start listeners: iptables|nft|ufw|firewall-cmd|pfctl|systemctl start sshd/telnet/dropbear; raw-socket/libpcap tools (tcpdump, tshark, nmap --raw). | DC0032 Process Creation |
| auditd:SYSCALL | socket/bind: New bind() to a previously closed port shortly after the sequence. | DC0082 Network Connection Creation |
| NSM:Flow | Knock pattern: repeated REJ/S0 across ≥MinSequenceLen ports from same src_ip then SF success. | DC0078 Network Traffic Flow |
Mutable elements
Parameters MITRE marks as environment-specific. These are the knobs you are expected to tune; they are why an analytic is not a rule.
| Field | Description |
|---|---|
ServicePort | Candidate port expected to open after knock (e.g., 22/2323). |
KnockTolerance | Max seconds between hits inside the sequence. |
MgmtAllowList | Automation allowed to change firewall/daemon state (config mgmt, orchestration). |