Adversaries may generate network traffic using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088 or port 587 as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
| ID | Name | Description |
|---|---|---|
| S0480 | Cerberus |
Cerberus communicates with the C2 using HTTP requests over port 8888.[1] |
| S1083 | Chameleon | |
| S0405 | Exodus |
Exodus Two attempts to connect to port 22011 to provide a remote reverse shell.[3] |
| S0408 | FlexiSpy |
FlexiSpy can communicate with the command and control server over ports 12512 and 12514.[4] |
| S0463 | INSOMNIA |
INSOMNIA has communicated with the C2 using HTTPS requests over ports 43111, 43223, and 43773.[5] |
| S1185 | LightSpy |
LightSpy has communicated with the C2 using ports 52202, 51200, 43201, 43202, 43203, and 21202.[6] |
| S0485 | Mandrake |
Mandrake has communicated with the C2 server over TCP port 7777.[7] |
| S0539 | Red Alert 2.0 |
Red Alert 2.0 has communicated with the C2 using HTTP requests over port 7878.[8] |
This type of attack technique cannot be easily mitigated with preventive controls since it is based on the abuse of system features.
| ID | Name | Analytic ID | Analytic Description |
|---|---|---|---|
| DET0706 | Detection of Non-Standard Port | AN1827 |
For Android, detect Non-Standard Port by correlating analyst-visible device/network evidence and management state; use streaming or batched telemetry only where the documented collector is deployed. Correlate Application Permission via Android Enterprise DPC / Application Vetting [DevicePolicyManager.getPermissionGrantState(); PackageManager manifest/requested-permission review]; Application State via Android Enterprise / EMM [Managed package inventory/status and package metadata]; Network Traffic Content via Enterprise Secure Web Gateway / Proxy [DNS/HTTP(S) inspection or proxy transaction metadata where enterprise decryption/inspection is deployed]. Alert on a sequence or state change inconsistent with the device/app baseline, approved management policy, or expected user workflow; do not infer unobserved API calls, file/process activity, or payload content from management state alone. |
| AN1828 |
For iOS, detect Non-Standard Port by correlating analyst-visible device/network evidence and management state; use streaming or batched telemetry only where the documented collector is deployed. Correlate Application Permission via Application Vetting [Code-signing entitlements and Info.plist privacy usage-description keys]; Application State via Apple MDM [InstalledApplicationList / ManagedApplicationList]; Network Traffic Content via Enterprise Secure Web Gateway / Proxy [DNS/HTTP(S) inspection or proxy transaction metadata where enterprise decryption/inspection is deployed]. Alert on a sequence or state change inconsistent with the device/app baseline, approved management policy, or expected user workflow; do not infer unobserved API calls, file/process activity, or payload content from management state alone. |