Adversaries may communicate using a protocol and port paring that are typically not associated. For example, HTTPS over port 8088^[1] or port 587^[2] as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.

ID: T1571

Sub-techniques: No sub-techniques

Tactic: Command And Control

Platforms: Linux, Windows, macOS

Data Sources: Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network

Version: 1.0

Created: 14 March 2020

Last Modified: 26 March 2020

Version Permalink

Live Version

Procedure Examples

Name	Description
APT-C-36	APT-C-36 has used port 4050 for C2 communications.^[24]
APT32	An APT32 backdoor can use HTTP over a non-standard TCP port (e.g 14146) which is specified in the backdoor configuration.^[22]
APT33	APT33 has used HTTP over TCP ports 808 and 880 for command and control.^[1]
BADCALL	BADCALL communicates on ports 443 and 8000 with a FakeTLS method.^[3]
Bankshot	Bankshot binds and listens on port 1058 for HTTP traffic while also utilizing a FakeTLS method.^[10]
DarkVishnya	DarkVishnya used ports 5190 and 7900 for shellcode listeners, and 4444, 4445, 31337 for shellcode C2.^[26]
Derusbi	Derusbi has used unencrypted HTTP on port 443 for C2.^[4]
Emotet	Emotet has used HTTP over ports such as 20, 22, 7080, and 50000, in addition to using ports commonly associated with HTTP/S.^[5]
FIN7	FIN7 has used port-protocol mismatches on ports such as 53, 80, 443, and 8080 during C2.^[18]
GravityRAT	GravityRAT has used HTTP over a non-standard port, such as TCP port 46769.^[11]
HARDRAIN	HARDRAIN binds and listens on port 443 with a FakeTLS method.^[6]
HOPLIGHT	HOPLIGHT has connected outbound over TCP port 443 with a FakeTLS method.^[7]
Lazarus Group	Some Lazarus Group malware uses a list of ordered port numbers to choose a port for C2 traffic, creating port-protocol mismatches.^[19]^[20]
Magic Hound	Magic Hound malware has communicated with its C2 server over TCP port 4443 using HTTP.^[23]
MoonWind	MoonWind communicates over ports 80, 443, 53, and 8080 via raw sockets instead of the protocols usually associated with the ports.^[8]
PoetRAT	PoetRAT used TLS to encrypt communications over port 143^[16]
RedLeaves	RedLeaves can use HTTP over non-standard ports, such as 995, for C2.^[12]
Rocke	Rocke's miner connects to a C2 server using port 51640.^[27]
RTM	RTM used Port 44443 for its VNC module.^[17]
Sandworm Team	Sandworm Team has used port 6789 to accept connections on the group's SSH server.^[28]
Silence	Silence has used port 444 when sending data about the system from the client to the server.^[25]
TEMP.Veles	TEMP.Veles has used port-protocol mismatches on ports such as 443, 4444, 8531, and 50501 during C2.^[21]
TrickBot	Some TrickBot samples have used HTTP over ports 447 and 8082 for C2.^[13]^[14]^[15]
TYPEFRAME	TYPEFRAME has used ports 443, 8080, and 8443 with a FakeTLS method.^[9]

Mitigations

Mitigation	Description
Network Intrusion Prevention	Network intrusion detection and prevention systems that use network signatures to identify traffic for specific adversary malware can be used to mitigate activity at the network level.
Network Segmentation	Properly configure firewalls and proxies to limit outgoing traffic to only necessary ports for that particular network segment.

Detection

Analyze packet contents to detect communications that do not follow the expected protocol behavior for the port that is being used. Analyze network data for uncommon data flows (e.g., a client sending significantly more data than it receives from a server). Processes utilizing the network that do not normally have network communication or have never been seen before are suspicious.^[29]

Non-Standard Port

Procedure Examples

Mitigations

Detection

References