tfMITRE ATT&CK sub-technique

Port Knocking T1205.001

sub-technique of T1205 Traffic Signaling

Tactics: Persistence, Stealth, Command and Control
Platforms: Linux, macOS, Network Devices, Windows
Version: 2.0
Created: 01 July 2020
Last modified: 12 May 2026

Adversaries may use port knocking to hide open ports used for persistence or command and control. To enable a port, an adversary sends a series of attempted connections to a predefined sequence of closed ports. After the sequence is completed, opening a port is often accomplished by the host based firewall, but could also be implemented by custom software.

ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact

Threat groups56th pct

Threat groups56th percentile · 56% of ATT&CK techniques have this many threat groups attributed or fewer.

CampaignsNone recorded

CampaignsNone recorded · 54% of ATT&CK techniques have none either.

Tools & malware62nd pct

Tools & malware62nd percentile · 62% of ATT&CK techniques have this many tools implementing them or fewer.

Detection rulesNone recorded

Detection rulesNone recorded · 33% of ATT&CK techniques have none either.

Port Knocking MITRE reference T1205.001

56th pctamong all ATT&CK techniques for number of groups

2 groups have been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.

UNC3886G1048 ↗

Maintained persistence on FortiGate Firewalls through ICMP port knocking.1

created 2025-05-291 reference

PROMETHIUMG0056 ↗

Has used a script that configures the knockd service and firewall to only accept C2 connections from systems that use a specified sequence of knock ports.1

created 2018-01-161 referenceaka StrongPity

All 2 groups for this technique

Offense vs defense T1205.001

Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.

Port Knocking detection strategy DET0302

MITRE names one behaviour worth catching for this technique and breaks it into 4 analytics, one per platform. Each carries the log sources it needs and the fields you tune per environment.

Port-knock → rule/daemon change → first successful connect (T1205.001)

Enterprise

4 platforms

AN0842 · Windows

A remote source rapidly touches a short sequence of closed ports (SYN→RST/S0) on a Windows host. Within a short window the host changes firewall state (WFP rule added/modified or service starts listening) and then the same source completes the first successful handshake to the newly opened port.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Process CreationDC0032	WinEventLog:Sysmon	EventCode=1
Network Traffic FlowDC0078	WinEventLog:Microsoft-Windows-Windows Firewall With Advanced Security/Firewall	EventCode=2004, 2005, 2006
Network Connection CreationDC0082	WinEventLog:Sysmon	EventCode=3, 22

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
TimeWindow	Seconds to correlate knock sequence → rule change → successful connect (60–300s typical).
MinSequenceLen	Minimum number of distinct destination ports in the sequence (≥3 by default).
RuleChangeAllowList	Accounts/processes allowed to adjust Windows Firewall (e.g., update agents).
WatchedPorts	Ports of interest to flag when opened (e.g., 22,23,2323,8022,3389,8080).

AN0843 · Linux

A source performs a short closed-port sequence; the host then modifies iptables/nftables/ufw rules or starts a daemon binding a new socket, followed by a successful connection from the same source.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Process CreationDC0032	auditd:SYSCALL	execve: Commands that alter firewall or start listeners: iptables\|nft\|ufw\|firewall-cmd\|pfctl\|systemctl start sshd/telnet/dropbear; raw-socket/libpcap tools (tcpdump, tshark, nmap --raw).
Network Traffic FlowDC0078	NSM:Flow	Knock pattern: repeated REJ/S0 across ≥MinSequenceLen ports from same src_ip then SF success.
Network Connection CreationDC0082	auditd:SYSCALL	socket/bind: New bind() to a previously closed port shortly after the sequence.

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
ServicePort	Candidate port expected to open after knock (e.g., 22/2323).
KnockTolerance	Max seconds between hits inside the sequence.
MgmtAllowList	Automation allowed to change firewall/daemon state (config mgmt, orchestration).

AN0844 · macOS

A source performs a closed-port sequence; the endpoint enables a PF/socketfilterfw rule or a background process binds a port; then a successful connection completes from the same source.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Process CreationDC0032	macos:unifiedlog	exec: Execution of pfctl, socketfilterfw, launchctl start ssh/telnet, libpcap consumers.
Network Traffic FlowDC0078	macos:unifiedlog	Firewall/PF anchor load or rule change events.
Network Connection CreationDC0082	NSM:Flow	Sequence of REJ/S0 then SF success from same src_ip within TimeWindow.

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
PFAnchorPaths	Anchors/confs to monitor (/etc/pf.conf, /etc/pf.anchors/*).
DevMode	Suppress expected PF testing on developer devices.

AN0845 · Network Devices

Router/switch receives a knock pattern (same src touches device unicast, broadcast, and network-address on same or stepped ports) followed by ACL/line-vty/service enable and the first mgmt session success.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Network Traffic FlowDC0078	networkdevice:syslog	Config/ACL changes, line vty transport input changes, telnet/ssh/http(s) enable, image/feature module changes.
Network Connection CreationDC0082	NSM:Flow	Series of denied/closed flows to distinct ports then success to mgmt port from same src_ip within TimeWindow.

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
MgmtPortSet	Mgmt ports to focus on: 22,23,2323,80,443,161,4786.
DeviceRole	Tighten thresholds on edge/internet-facing devices.

Port Knocking detections T1205.001

No detection rules are mapped to this technique yet.

None recorded— 33% of ATT&CK techniques have none either

Drag headers to reorder | Drag edges to resize

Loading detections...

Select	Title	Description	Category	Status	Event	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID	Refs