T1571
Non-Standard Port
ESXi · Linux · macOS · Windows1 piece on this siteT1571 on attack.mitre.org
Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088 or port 587 as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data. Adversaries may also make changes to victim systems to abuse non-standard ports.
The evidence it leaves
Where the traces live, and what each source proves and does not.
Artifact reference
Zeek conn.log
T1571
how MITRE says to see it
Detection Strategy for Non-Standard Ports
- Processes initiating outbound connections on uncommon ports or using protocols inconsistent with the assigned port. Correlating process creation with subsequent network connections reveals anomalies such as svchost.exe or Office applications using high, atypical ports.
- Unusual daemons or user processes binding/listening on ports outside of standard ranges, or initiating client connections using mismatched protocol/port pairings.
- Applications making outbound connections on non-standard ports or launchd services bound to ports inconsistent with system baselines.
- VM services or management daemons communicating on ports not defined by VMware defaults, such as vpxa or hostd processes initiating traffic over high-numbered or unexpected ports.
what reduces it
- M1031 Network Intrusion Prevention. Network intrusion detection and prevention systems that use network signatures to identify traffic for specific adversary malware can be used to mitigate activity at the network level.
- M1030 Network Segmentation. Properly configure firewalls and proxies to limit outgoing traffic to only necessary ports for that particular network segment.