tfMITRE ATT&CK technique

Traffic Signaling T1205

Tactics: Persistence, Stealth, Command and Control
Platforms: Linux, macOS, Network Devices, Windows
Version: 3.0
Created: 18 April 2018
Last modified: 12 May 2026
Contributors: Josh Day, Gigamon; Tony Lee

Sub-techniques 20 rules across the family · 0 mapped directly to T1205 · 0 of 2 carry rules

Adversaries may use traffic signaling to hide open ports or other malicious functionality used for persistence or command and control. Traffic signaling involves the use of a magic value or sequence that must be sent to a system to trigger a special response, such as opening a closed port or executing a malicious task. This may take the form of sending a series of packets with certain characteristics before a port will be opened that the adversary can use for command and control. Usually this series of packets consists of attempted connections to a predefined sequence of closed ports (i.e. Port Knocking), but can involve unusual flags, specific strings, or other unique characteristics. After the sequence is completed, opening a port may be accomplished by the host-based firewall, but could also be implemented by custom software.

ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact

Threat groups64th pct

Threat groups64th percentile · 64% of ATT&CK techniques have this many threat groups attributed or fewer.

CampaignsTop 17%

Campaigns83rd percentile · 83% of ATT&CK techniques have this many campaigns recorded or fewer.

Tools & malwareTop 19%

Tools & malware81st percentile · 81% of ATT&CK techniques have this many tools implementing them or fewer.

Detection rulesNone recorded

Detection rulesNone recorded · 33% of ATT&CK techniques have none either.

Traffic Signaling MITRE reference T1205

64th pctamong all ATT&CK techniques for number of groups

3 groups have been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.

UNC3886G1048 ↗

Has used the TABLEFLIP traffic redirection utility to listen for specialized command packets on compromised FortiManager devices.1

created 2025-05-291 reference

Mustang PandaG0129 ↗

Has utilized a magic value in C2 communications and only executes in memory when response packets match specific values of “17 03 03” or “46 77 4d”.1

created 2021-04-121 referenceaka TA416

KimsukyG0094 ↗

Has used TRANSLATEXT to redirect clients to legitimate Gmail, Naver or Kakao pages if the clients connect with no parameters.1

created 2019-08-261 referenceaka Black Banshee

All 3 groups for this technique

2 campaigns have been recorded using this technique. Listed newest first; dates are year-granularity and attribution is MITRE’s.

RedPenguinC0056 ↗

During RedPenguin, UNC3886 leveraged malware capable of inpecting packets for a magic-string to activate backdoor functionalities.1

2024–2025

Cutting EdgeC0029 ↗

During Cutting Edge, threat actors sent a magic 48-byte sequence to enable the PITSOCK backdoor to communicate via the /tmp/clientsDownload.sock socket.1

2023–2024

All 2 campaigns for this technique

Offense vs defense T1205

Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.

Traffic Signaling detection strategy DET0524

MITRE names one behaviour worth catching for this technique and breaks it into 4 analytics, one per platform. Each carries the log sources it needs and the fields you tune per environment.

Traffic Signaling (Port-knock / magic-packet → firewall or service activation) – T1205

Enterprise

4 platforms

AN1448 · Windows

A remote host sends a short sequence of failed connection attempts (RST/ICMP unreachable) to a set of closed ports. Within a brief window the endpoint (a) adds/enables a firewall rule or (b) a sniffer-backed process begins listening or opens a new socket, after which a successful connection occurs. Also detects Wake-on-LAN magic packets seen on local segment.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Process CreationDC0032	WinEventLog:Sysmon	EventCode=1
Command ExecutionDC0064	WinEventLog:PowerShell	EventCode=4103, 4104, 4105, 4106
Network Traffic FlowDC0078	WinEventLog:Microsoft-Windows-Windows Firewall With Advanced Security/Firewall	EventCode=2004, 2005, 2006
Network Connection CreationDC0082	WinEventLog:Sysmon	EventCode=3, 22

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
TimeWindowKnock	Window to correlate knock sequence → rule change → successful connect (e.g., 120s).
PortSequenceMinLen	Minimum number of distinct closed ports hit before success (e.g., 3).
SuspiciousProcesses	List of binaries that commonly toggle firewall/sniff (netsh.exe, powershell.exe, npcapservice.exe, windivert, rawsock tools).
AllowedFirewallChangers	Service accounts or software update agents allowed to change firewall.
WoLAllowedWindows	Maintenance windows when magic packets are expected.

AN1449 · Linux

Closed-port knock sequence from a remote IP followed by on-host firewall change (iptables/nftables) or daemon starts listening (socket open) and a successful TCP/UDP connect. Optional detection of libpcap/raw-socket sniffers spawning to watch for secret values.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Process CreationDC0032	auditd:SYSCALL	execve: Commands altering firewall or enabling listeners (iptables, nft, ufw, firewall-cmd, systemctl start ssh/telnet, ip route add, tcpdump, tshark)
Network Traffic FlowDC0078	NSM:Flow	Knock pattern: multiple REJ/S0 to distinct closed ports then successful connection to service_port
Network Connection CreationDC0082	auditd:SYSCALL	socket/bind: Process binds to a new local port shortly after knock
Network Traffic ContentDC0085	NSM:Flow	Packets with unusual flags or payloads outside established flows (e.g., WoL magic FF×6 + 16×MAC)

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
ServicePort	Port that becomes available post-knock (e.g., 22/8022/2323).
KnockResetRatio	Percentage of failed attempts with RST/ICMP vs SYN/SYN-ACK to qualify as closed-port probing.
ProcessAllowList	Automation expected to touch firewall/daemon configs (config-mgmt agents).

AN1450 · macOS

Remote knock sequence followed by PF/socketfilterfw rule update or a background process listening on a new port; then a successful TCP session. Also flags WoL magic packets on local segment.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Process CreationDC0032	macos:unifiedlog	exec: Execution of /sbin/pfctl, /usr/libexec/ApplicationFirewall/socketfilterfw, ifconfig, tcpdump, npcap/libpcap consumers
Network Traffic FlowDC0078	macos:unifiedlog	Firewall rule enable/disable or listen socket changes
Network Connection CreationDC0082	NSM:Flow	Closed-port hits followed by success from same src_ip

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
PFAnchorPaths	Anchors or conf files monitored for change (/etc/pf.conf, /etc/pf.anchors/*).
DeveloperMode	Reduce noise on dev endpoints compiling or testing PF rules.

AN1451 · Network Devices

Crafted ‘synful knock’ patterns toward routers/switches (same src hits interface/broadcast/network address on same port in short order) followed by ACL/telnet/SSH enablement or module change. Detect device image/ACL updates then a new mgmt session.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Network Traffic FlowDC0078	networkdevice:syslog	Config/ACL/line vty changes, service enable (telnet/ssh/http(s)), module reloads
Network Connection CreationDC0082	NSM:Flow	Port-knock pattern from one src to device unicast,broadcast,network addresses on same port within TimeWindowKnock

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
MgmtPortSet	Ports whose sudden enablement should alert (23, 22, 2323, 80/443, 4786).
DeviceRole	Applies different thresholds to core/edge/branch devices.

Traffic Signaling detections T1205

No detection rules are mapped to this technique yet.

None recorded— 33% of ATT&CK techniques have none either

Drag headers to reorder | Drag edges to resize

Loading detections...

Select	Title	Description	Category	Status	Event	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID	Refs