Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088[1] or port 587[2] as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Adversaries may also make changes to victim systems to abuse non-standard ports. For example, Registry keys and other configuration settings can be used to modify protocol and port pairings.[3]
Top 11%of all ATT&CK techniques for number of groups
17 groups have been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.
All 8 campaigns for this technique · 6 newest in this preview
41 software entries are documented implementing this technique. MITRE files each as a tool or as malware; newest first, then by how many groups carry them.
MITRE names one behaviour worth catching for this technique and breaks it into 4 analytics, one per platform. Each carries the log sources it needs and the fields you tune per environment.
Detection Strategy for Non-Standard Ports
Enterprise
4 platforms
AN0633 · Windows
Processes initiating outbound connections on uncommon ports or using protocols inconsistent with the assigned port. Correlating process creation with subsequent network connections reveals anomalies such as svchost.exe or Office applications using high, atypical ports.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
Field
What you tune
PortThresholds
Define what constitutes a 'non-standard port' based on organizational baselines (e.g., allow 443/80/22 but flag 8088/587/3389 changes).
ProcessAllowList
Processes normally allowed to use non-standard ports (e.g., custom apps).
TimeWindow
Correlate process creation and network activity within N seconds.
AN0634 · Linux
Unusual daemons or user processes binding/listening on ports outside of standard ranges, or initiating client connections using mismatched protocol/port pairings.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
Field
What you tune
BaselinePortProfiles
Define expected macOS service port usage (e.g., AirDrop, Bonjour).
AN0636 · ESXi
VM services or management daemons communicating on ports not defined by VMware defaults, such as vpxa or hostd processes initiating traffic over high-numbered or unexpected ports.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
Network intrusion detection and prevention systems that use network signatures to identify traffic for specific adversary malware can be used to mitigate activity at the network level.
Properly configure firewalls and proxies to limit outgoing traffic to only necessary ports for that particular network segment.
Tests2Executorspowershell 1 · sh 1Need elevation0 of 2Have prerequisites1Have cleanup0Platformswindows, linux, macos
#
Test
Platform
Executor
Elevation
Prereqs
Cleanup
Ref
01
Testing usage of uncommonly used port with PowerShell
windows
powershell
—
—
—
Testing uncommonly used port utilizing PowerShell. APT33 has been known to attempt telnet over port 8081. Upon execution, details about the successful
port check will be displayed.
The following analytic detects potential reverse shell activity by identifying connections involving ports commonly associated with remote access tools, shell listeners, or tunneling utilities. (...)