Techniques › T1205 › AN1449
AN1449 Analytic 1449
Linux · attack.mitre.org · ATT&CK Enterprise v19.2
<p>Closed-port knock sequence from a remote IP followed by on-host firewall change (iptables/nftables) or daemon starts listening (socket open) and a successful TCP/UDP connect. Optional detection of libpcap/raw-socket sniffers spawning to watch for secret values.</p>
- Detects
- T1205 Traffic Signaling
- Part of
- DET0524 Traffic Signaling (Port-knock / magic-packet → firewall or service activation) – T1205
Log sources and channels
Exactly as MITRE states them in x_mitre_log_source_references. Where a channel is vague, it is vague in the source; kevmap does not tidy it.
| Log source | Channel | Data component |
|---|---|---|
| auditd:SYSCALL | execve: Commands altering firewall or enabling listeners (iptables, nft, ufw, firewall-cmd, systemctl start *ssh*/*telnet*, ip route add, tcpdump, tshark) | DC0032 Process Creation |
| auditd:SYSCALL | socket/bind: Process binds to a new local port shortly after knock | DC0082 Network Connection Creation |
| NSM:Flow | Knock pattern: multiple REJ/S0 to distinct closed ports then successful connection to service_port | DC0078 Network Traffic Flow |
| NSM:Flow | Packets with unusual flags or payloads outside established flows (e.g., WoL magic FF×6 + 16×MAC) | DC0085 Network Traffic Content |
Mutable elements
Parameters MITRE marks as environment-specific. These are the knobs you are expected to tune; they are why an analytic is not a rule.
| Field | Description |
|---|---|
ServicePort | Port that becomes available post-knock (e.g., 22/8022/2323). |
KnockResetRatio | Percentage of failed attempts with RST/ICMP vs SYN/SYN-ACK to qualify as closed-port probing. |
ProcessAllowList | Automation expected to touch firewall/daemon configs (config-mgmt agents). |