T1571 Non-Standard Port

command and control — ESXi, Linux, macOS, Windows · attack.mitre.org · JSON

MITRE detection strategy

analytics

Sigma rules tagged attack.t1571

KEV CVEs mapped here

<p>Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088 or port 587 as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.</p><p>Adversaries may also make changes to victim systems to abuse non-standard ports. For example, Registry keys and other configuration settings can be used to modify protocol and port pairings.</p>

KEV CVEs mapped to this technique · CTID Mappings Explorer

CVE	Vendor / product	Mapping type	State	Added
CVE-2023-38035	Ivanti Sentry	secondary impact	Mapped	2023-08-22

Detection strategy · ATT&CK Enterprise v19.2

DET0227 Detection Strategy for Non-Standard Ports v1.0
AN0633 Windows
Processes initiating outbound connections on uncommon ports or using protocols inconsistent with the assigned port. Correlating process creation with subsequent network connections reveals anomalies such as svchost.exe or Office applications using high, atypical ports.

WinEventLog:Security EventCode=5156, 5157 → DC0082 Network Connection Creation
WinEventLog:Sysmon EventCode=1 → DC0032 Process Creation

Tunable: PortThresholds ProcessAllowList TimeWindow

AN0634 Linux
Unusual daemons or user processes binding/listening on ports outside of standard ranges, or initiating client connections using mismatched protocol/port pairings.

auditd:SYSCALL socket/connect syscalls → DC0078 Network Traffic Flow
linux:syslog processes binding to non-standard ports or sshd configured on unexpected port → DC0038 Application Log Content
linux:osquery process listening or connecting on non-standard ports → DC0032 Process Creation

Tunable: AllowedServices PayloadEntropyThreshold

AN0635 macOS
Applications making outbound connections on non-standard ports or launchd services bound to ports inconsistent with system baselines.

macos:unifiedlog outbound TCP/UDP traffic over unexpected port → DC0078 Network Traffic Flow
macos:unifiedlog launchd services binding to non-standard ports → DC0032 Process Creation

Tunable: BaselinePortProfiles

AN0636 ESXi
VM services or management daemons communicating on ports not defined by VMware defaults, such as vpxa or hostd processes initiating traffic over high-numbered or unexpected ports.

esxi:vpxd ESXi service connections on unexpected ports → DC0078 Network Traffic Flow
esxcli:network listening sockets bound to non-standard ports → DC0085 Network Traffic Content

Tunable: ESXiAllowedPorts

Sigma rules · SigmaHQ da9bb07d64, tag `attack.t1571`

Potentially Suspicious Malware Callback Communication hightest

Author: Florian Roth (Nextron Systems) · 2017-03-19 (modified 2024-03-12) · logsource: product=windows category=network_connection · 4b89abaa-99fe-4232-afdd-8f9aa4d20382

Detects programs that connect to known malware callback ports based on statistical analysis from two different sandbox system databases

Techniques: T1571

Communication To Uncommon Destination Ports mediumtest

Author: Florian Roth (Nextron Systems) · 2017-03-19 (modified 2024-03-12) · logsource: product=windows category=network_connection · 6d8c3d20-a5e1-494f-8412-4571d716cf5c

Detects programs that connect to uncommon destination ports

Techniques: T1571

Testing Usage of Uncommonly Used Port mediumtest

Author: frack113 · 2022-01-23 · logsource: product=windows category=ps_script · adf876b3-f1f8-4aa9-a4e4-a64106feec06

Adversaries may communicate using a protocol and port paring that are typically not associated. For example, HTTPS over port 8088(Citation: Symantec Elfin Mar 2019) or port 587(Citation: Fortinet Agent Tesla April 2018) as opposed to the traditional port 443.

Techniques: T1571

Potentially Suspicious Malware Callback Communication - Linux hightest

Author: hasselj · 2024-05-10 · logsource: product=linux category=network_connection · dbfc7c98-04ab-4ab7-aa94-c74d22aa7376

Detects programs that connect to known malware callback ports based on threat intelligence reports.

Techniques: T1571

Suspicious DNS Z Flag Bit Set mediumtest

Author: @neu5ron, SOC Prime Team, Corelight · 2021-05-04 (modified 2022-11-29) · logsource: product=zeek service=dns · ede05abc-2c9e-4624-9944-9ff17fdc0bf5

The DNS Z flag is bit within the DNS protocol header that is, per the IETF design, meant to be used reserved (unused). Although recently it has been used in DNSSec, the value being set to anything other than 0 should be rare. Otherwise if it is set to non 0 and DNSSec is being used, then excluding the legitimate domains is low effort and high reward. Determine if multiple of these files were accessed in a short period of time to further enhance the possibility of seeing if this was a one off or the possibility of larger sensitive file gathering. This Sigma query is designed to accompany the Corelight Threat Hunting Guide, which can be found here: https://www3.corelight.com/corelights-introductory-guide-to-threat-hunting-with-zeek-bro-logs'

Techniques: T1095 T1571

T1571 Non-Standard Port

KEV CVEs mapped to this technique · CTID Mappings Explorer

Detection strategy · ATT&CK Enterprise v19.2

Sigma rules · SigmaHQ da9bb07d64, tag attack.t1571

Sigma rules · SigmaHQ da9bb07d64, tag `attack.t1571`