THREATNOIR
Subscribe
MITRE ATT&CK · T1571

Non-Standard Port

MITRE · cited in 6 of our lessons

Explanation

What attackers do. Attackers use a protocol on a port where it does not normally run, such as web traffic on an unusual high port, to slip past simple filtering. This serves the Command and Control tactic.

How to defend. Restrict outbound traffic to the ports and protocols the business needs, and send web traffic through proxies. Use network monitoring that identifies protocols by content rather than port number. Correlate firewall logs with endpoint data so you can see which process opened each unusual connection. Review exceptions to egress rules regularly so temporary openings do not become permanent.

Signs to look for. Look for web or other common protocols on unusual ports, outbound connections to high ports from hosts that do not need them, and protocol mismatches flagged by network sensors. A common gap is permissive outbound rules that allow any port.

Open the technique on MITRE ATT&CK
The official text
Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088 or port 587 as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data. Adversaries may also make changes to victim systems to abuse non-standard ports. For example, Registry keys and other configuration settings can be used to modify protocol and port pairings.

© The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation (MITRE ATT&CK®).

Lessons that cite it

Real incidents where this item mattered.