Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088(Citation: Symantec Elfin Mar 2019) or port 587(Citation: Fortinet Agent Tesla April 2018) as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Adversaries may also make changes to victim systems to abuse non-standard ports. For example, Registry keys and other configuration settings can be used to modify protocol and port pairings.(Citation: change_rdp_port_conti)
View in MITRE ATT&CK®| Capability ID | Capability Description | Mapping Type | ATT&CK ID | ATT&CK Name | Notes |
|---|---|---|---|---|---|
| CIS-12.8 | Establish and Maintain Dedicated Computing Resources for All Administrative Work | mitigates | T1571 | Non-Standard Port |
Comments
Adversaries use unexpected ports for command-and-control to evade standard network restrictions. The administrative enclave permits only explicitly approved ports and denies all others, directly preventing outbound communication over unauthorized ports.
References
|
| CIS-12.2 | Establish and Maintain a Secure Network Architecture | mitigates | T1571 | Non-Standard Port |
Comments
Adversaries communicate over unusual ports to evade expected network controls. Explicit port allowlists and default-deny inter-zone filtering block unapproved ports, directly preventing those communications from traversing protected network boundaries.
References
|
| CIS-13.8 | Deploy a Network Intrusion Prevention Solution | mitigates | T1571 | Non-Standard Port |
Comments
Network intrusion prevention solutions can use signatures for known adversary malware to block malicious traffic using non-standard ports at monitored network boundaries.
References
|
| CIS-4.5 | Implement and Manage a Firewall on End-User Devices | mitigates | T1571 | Non-Standard Port |
Comments
Default-deny rules directly block arbitrary and unexpected ports unless they have been explicitly approved, limiting adversary communications over non-standard ports.
References
|
| CIS-4.4 | Implement and Manage a Firewall on Servers | mitigates | T1571 | Non-Standard Port |
Comments
A default-deny firewall blocks communication over arbitrary or non-standard ports unless they are explicitly permitted, directly limiting adversary use of unexpected ports.
References
|
| CIS-16.8 | Separate Production and Non-Production Systems | mitigates | T1571 | Non-Standard Port |
Comments
Boundary firewalls between production and non-production environments can allow only explicitly required ports, preventing arbitrary cross-environment communication over non-standard or unauthorized ports.
References
|
| Capability ID | Capability Description | Mapping Type | ATT&CK ID | ATT&CK Name | Notes |
|---|---|---|---|---|---|
| action.hacking.vector.Other network service | Network service that is not remote access or a web application. | related-to | T1571 | Non-Standard Port | |
| action.malware.variety.Backdoor or C2 | Malware creates a remote control capability, but it's unclear if it's a backdoor for hacking or C2 for malware. Parent of 'C2' and 'Backdoor'. | related-to | T1571 | Non-Standard Port | |
| action.malware.variety.C2 | Malware creates Command and Control capability for malware. Child of 'Backdoor or C2'. | related-to | T1571 | Non-Standard Port |
| Capability ID | Capability Description | Mapping Type | ATT&CK ID | ATT&CK Name | Notes |
|---|---|---|---|---|---|
| cloud_ngfw | Cloud Next-Generation Firewall (NGFW)_ | technique_scores | T1571 | Non-Standard Port |
Comments
Cloud NGFW can allow or deny traffic based on the traffic's protocol, destination ports, sources, and destinations. This functionality can be used to restrict which protocols and port numbers are allowed through the firewall and prevent adversaries from using non-standard ports. As a result, this mapping is given a score of Significant.
References
|
| Capability ID | Capability Description | Mapping Type | ATT&CK ID | ATT&CK Name | Notes |
|---|---|---|---|---|---|
| aws_network_firewall | AWS Network Firewall | technique_scores | T1571 | Non-Standard Port |
Comments
AWS Network Firewall has the ability to pass, drop, or alert on traffic based on the network protocol as well as perform deep packet inspection on the payload. This functionality can be used to restrict which protocols and port numbers are allowed through the firewall and prevent adversaries from using non-standard ports. As a result, this mapping is given a score of Significant.
References
|
| amazon_guardduty | Amazon GuardDuty | technique_scores | T1571 | Non-Standard Port |
Comments
GuardDuty has the following finding type to flag events where adversaries may communicate using a protocol and port paring that are typically not associated.
Behavior:EC2/NetworkPortUnusual
References
|
| amazon_virtual_private_cloud | Amazon Virtual Private Cloud | technique_scores | T1571 | Non-Standard Port |
Comments
VPC security groups and network access control lists (NACLs) can limit access to the minimum required ports and therefore, protect against adversaries attempting to use non-standard ports for C2 traffic.
References
|