T1571 Non-Standard Port
Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088(Citation: Symantec Elfin Mar 2019) or port 587(Citation: Fortinet Agent Tesla April 2018) as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.…
Who uses it · with stories on Jábega
Sigma rules to hunt it
- Potentially Suspicious Malware Callback Communicationhightest · windows
- Potentially Suspicious Malware Callback Communication - Linuxhightest · linux
- Communication To Uncommon Destination Portsmediumtest · windows
- Suspicious DNS Z Flag Bit Setmediumtest · zeek
- Testing Usage of Uncommonly Used Portmediumtest · windows
Rules from SigmaHQ · Detection Rule License 1.1. Technique from MITRE ATT&CK®.