[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"framework:mitre-attack\u002Ft1571":3},{"item":4,"lessons":18,"controls":44,"related":72},{"family":5,"item":6,"code":7,"title":8,"citations":9,"publisher":10,"summary_md":11,"official_text":12,"official_attribution":13,"official_url":14,"link_label":15,"note":16,"updated_at":17},"mitre-attack","t1571","T1571","Non-Standard Port",6,"MITRE","**What attackers do.** Attackers use a protocol on a port where it does not normally run, such as web traffic on an unusual high port, to slip past simple filtering. This serves the Command and Control tactic.\n\n**How to defend.** Restrict outbound traffic to the ports and protocols the business needs, and send web traffic through proxies. Use network monitoring that identifies protocols by content rather than port number. Correlate firewall logs with endpoint data so you can see which process opened each unusual connection. Review exceptions to egress rules regularly so temporary openings do not become permanent.\n\n**Signs to look for.** Look for web or other common protocols on unusual ports, outbound connections to high ports from hosts that do not need them, and protocol mismatches flagged by network sensors. A common gap is permissive outbound rules that allow any port.","Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088 or port 587 as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis\u002Fparsing of network data.\n\nAdversaries may also make changes to victim systems to abuse non-standard ports. For example, Registry keys and other configuration settings can be used to modify protocol and port pairings.","© The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation (MITRE ATT&CK®).","https:\u002F\u002Fattack.mitre.org\u002Ftechniques\u002FT1571\u002F","Open the technique on MITRE ATT&CK",null,"2026-10-18T15:18:43.663+00:00",{"total":9,"list":19},[20,24,28,32,36,40],{"slug":21,"title":22,"published_at":23},"silent-lynx-exploits-unpatched-winrar-flaw-to-backdoor-cis-governments","Silent Lynx Exploits Unpatched WinRAR Flaw to Backdoor CIS Governments","2026-10-15T18:20:53.262+00:00",{"slug":25,"title":26,"published_at":27},"famoussparrow-deploys-sparrowocky-backdoor-against-government-targets","FamousSparrow Deploys SparroWocky Backdoor Against Government Targets","2026-09-17T10:20:58.773+00:00",{"slug":29,"title":30,"published_at":31},"sality-botnet-dismantled-after-20-years-of-global-malicious-activity","Sality Botnet Dismantled After 20 Years of Global Malicious Activity","2026-09-02T10:22:18.213+00:00",{"slug":33,"title":34,"published_at":35},"23-year-old-sality-botnet-finally-disrupted-after-decades-of-malware-distribution","23-Year-Old Sality Botnet Finally Disrupted After Decades of Malware Distribution","2026-09-02T10:21:43.734+00:00",{"slug":37,"title":38,"published_at":39},"state-sponsored-backdoors-exploit-government-networks-across-six-nations","State-Sponsored Backdoors Exploit Government Networks Across Six Nations","2026-08-05T20:21:08.645+00:00",{"slug":41,"title":42,"published_at":43},"chinese-apt-deploys-tinyrct-backdoor-against-southeast-asian-government-targets","Chinese APT Deploys TinyRCT Backdoor Against Southeast Asian Government Targets","2026-06-26T18:20:58.161+00:00",[45,49,54,59,64,68],{"slug":46,"name":47,"problem":48,"stories":9},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",{"slug":50,"name":51,"problem":52,"stories":53},"network-detection-response","Network detection and response (NDR)","Attackers moving between systems inside the network get seen.",5,{"slug":55,"name":56,"problem":57,"stories":58},"dns-web-filtering","DNS filtering and secure web gateway","Users cannot reach known-malicious sites, and malware cannot phone home.",2,{"slug":60,"name":61,"problem":62,"stories":63},"patch-management","Automated patch management","Known holes get closed in days, not months.",1,{"slug":65,"name":66,"problem":67,"stories":63},"email-security","Email security","Phishing, malware and invoice fraud are filtered out before they reach inboxes.",{"slug":69,"name":70,"problem":71,"stories":63},"privileged-access-management","Privileged access management (PAM)","Admin accounts stop being one stolen password away from control of everything.",[73,78,83,88,93,97,101,105],{"family":74,"item":75,"code":76,"title":77,"together":9},"cis","13","Control 13","Network Monitoring and Defense",{"family":79,"item":80,"code":81,"title":82,"together":53},"nist-800-53","si-3","SI-3","Malicious Code Protection",{"family":79,"item":84,"code":85,"title":86,"together":87},"ir-4","IR-4","Incident Handling",4,{"family":79,"item":89,"code":90,"title":91,"together":92},"sc-7","SC-7","Boundary Protection",3,{"family":74,"item":94,"code":95,"title":96,"together":92},"17","Control 17","Incident Response Management",{"family":98,"item":99,"code":100,"title":100,"together":92},"itil","overview","ITIL",{"family":79,"item":102,"code":103,"title":104,"together":92},"au-6","AU-6","Audit Record Review, Analysis, and Reporting",{"family":5,"item":106,"code":107,"title":108,"together":92},"t1059","T1059","Command and Scripting Interpreter"]