T1571 Non-Standard Port
Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088(Citation: Symantec Elfin Mar 2019) or port 587(Citation: Fortinet Agent Tesla April 2018) as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.…
Quién la usa · con noticias en Jábega
Reglas Sigma para cazarla
- Potentially Suspicious Malware Callback Communicationhightest · windows
- Potentially Suspicious Malware Callback Communication - Linuxhightest · linux
- Communication To Uncommon Destination Portsmediumtest · windows
- Suspicious DNS Z Flag Bit Setmediumtest · zeek
- Testing Usage of Uncommonly Used Portmediumtest · windows
Reglas de SigmaHQ · Detection Rule License 1.1. Técnica de MITRE ATT&CK®.