tfMITRE ATT&CK technique

Non-Standard Port T1571

Tactic: Command and Control
Platforms: ESXi, Linux, macOS, Windows
Version: 1.3
Created: 14 March 2020
Last modified: 12 May 2026

Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088[1] or port 587[2] as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.

ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact

Threat groupsTop 11%

Threat groups89th percentile · 89% of ATT&CK techniques have this many threat groups attributed or fewer.

CampaignsTop 5%

Campaigns95th percentile · 95% of ATT&CK techniques have this many campaigns recorded or fewer.

Tools & malwareTop 10%

Tools & malware90th percentile · 90% of ATT&CK techniques have this many tools implementing them or fewer.

Detection rules74th pct

Detection rules74th percentile · 74% of ATT&CK techniques have this many detection rules written or fewer.

Non-Standard Port MITRE reference T1571

Top 11%of all ATT&CK techniques for number of groups

17 groups have been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.

Contagious InterviewG1052 ↗

Has used TCP port 1224 for C2.1

created 2025-10-191 referenceaka DeceptiveDevelopment

Velvet AntG1047 ↗

Has used random high number ports for PlugX listeners on victim devices.1

created 2025-03-141 reference

RedEchoG1042 ↗

Has used non-standard ports such as TCP 8080 for HTTP communication.1

created 2024-11-211 reference

Ember BearG1003 ↗

Has used various non-standard ports for C2 communication.1

created 2022-06-091 referenceaka UNC2589

RockeG0106 ↗

Rocke's miner connects to a C2 server using port 51640.1

created 2020-05-261 reference

DarkVishnyaG0105 ↗

Used ports 5190 and 7900 for shellcode listeners, and 4444, 4445, 31337 for shellcode C2.1

created 2020-05-151 reference

All 17 groups for this technique · 6 newest in this preview

Offense vs defense T1571

Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.

How it got here

Range

Adversary activity (campaign spans) over cumulative rule output. Each source is plotted independently from zero, so neither line includes the other. Campaign dates are year-granularity.

Campaigns · 8Sigma rules (cumulative) · 6Splunk ESCU (cumulative) · 4

first rule: 2017 Q1 · 8 of 8 campaigns plotted

Non-Standard Port detection strategy DET0227

MITRE names one behaviour worth catching for this technique and breaks it into 4 analytics, one per platform. Each carries the log sources it needs and the fields you tune per environment.

Detection Strategy for Non-Standard Ports

Enterprise

4 platforms

AN0633 · Windows

Processes initiating outbound connections on uncommon ports or using protocols inconsistent with the assigned port. Correlating process creation with subsequent network connections reveals anomalies such as svchost.exe or Office applications using high, atypical ports.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Process CreationDC0032	WinEventLog:Sysmon	EventCode=1
Network Connection CreationDC0082	WinEventLog:Security	EventCode=5156, 5157

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
PortThresholds	Define what constitutes a 'non-standard port' based on organizational baselines (e.g., allow 443/80/22 but flag 8088/587/3389 changes).
ProcessAllowList	Processes normally allowed to use non-standard ports (e.g., custom apps).
TimeWindow	Correlate process creation and network activity within N seconds.

AN0634 · Linux

Unusual daemons or user processes binding/listening on ports outside of standard ranges, or initiating client connections using mismatched protocol/port pairings.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Process CreationDC0032	linux:osquery	process listening or connecting on non-standard ports
Application Log ContentDC0038	linux:syslog	processes binding to non-standard ports or sshd configured on unexpected port
Network Traffic FlowDC0078	auditd:SYSCALL	socket/connect syscalls

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
AllowedServices	Exclude ports intentionally configured for enterprise apps.
PayloadEntropyThreshold	Define thresholds for anomalous payload entropy to catch tunneled traffic.

AN0635 · macOS

Applications making outbound connections on non-standard ports or launchd services bound to ports inconsistent with system baselines.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Process CreationDC0032	macos:unifiedlog	launchd services binding to non-standard ports
Network Traffic FlowDC0078	macos:unifiedlog	outbound TCP/UDP traffic over unexpected port

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
BaselinePortProfiles	Define expected macOS service port usage (e.g., AirDrop, Bonjour).

AN0636 · ESXi

VM services or management daemons communicating on ports not defined by VMware defaults, such as vpxa or hostd processes initiating traffic over high-numbered or unexpected ports.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Network Traffic FlowDC0078	esxi:vpxd	ESXi service connections on unexpected ports
Network Traffic ContentDC0085	esxcli:network	listening sockets bound to non-standard ports

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
ESXiAllowedPorts	Default VMware service ports that should not be flagged.

Tests2ExecutorsPowerShell 1 · sh 1Need elevation0 of 2Have prerequisites1Have cleanup0Platformswindows, linux, macos

Test

Platform

Executor

Elevation

Prereqs

Cleanup

Ref

Testing usage of uncommonly used port with PowerShell

windows

PowerShell

—

Testing uncommonly used port utilizing PowerShell. APT33 has been known to attempt telnet over port 8081. Upon execution, details about the successful port check will be displayed.

Input arguments

Name	Type	Default	Description
port	string	8081	Specify uncommon port number
domain	string	google.com	Specify target hostname

Attack command

Test-NetConnection -ComputerName #{domain} -port #{port}

GUID827ef91f-30d1-4f45-ae4d-0200d7c20401

Testing usage of uncommonly used port

linux, macos

—

Testing uncommonly used port utilizing telnet.

Input arguments

Name	Type	Default	Description
port	string	8081	Specify uncommon port number
domain	string	google.com	Specify target hostname

Attack command

echo quit | telnet #{domain} #{port}
exit 0

Prerequisite

Requires telnet

Check

which telnet

Satisfy

echo "please install telnet to run this test"; exit 1

GUID43d7fd14-3154-4590-b2e1-c334b2a44a5f

Tests from Atomic Red Team (MIT licence) · technique definition

Non-Standard Port detections T1571

10 rules are mapped to this technique. Parent techniques also include their sub-techniques’ rules. Click a slice or key entry to filter the table.

74th pctamong all ATT&CK techniques for number of rules

Product

Severity

Library

Drag headers to reorder | Drag edges to resize

Loading detections...

Select	Title	Description	Category	Status	Event	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID	Refs