Cross-source coverage

T1205 / ATT&CK

Traffic Signaling

9 rules · 7 families across 5 sources.

1 deprecated hidden · include 10 atomic-IOC hidden · include

From MITRE ATT&CK 19.2

Adversaries may use traffic signaling to hide open ports or other malicious functionality used for persistence or command and control. Traffic signaling involves the use of a magic value or sequence that must be sent to a system to trigger a special response, such as opening a closed port or executing a malicious task. This may take the form of sending a series of packets with certain characteristics before a port will be opened that the adversary can use for command and control. Usually this series of packets consists of attempted connections to a predefined sequence of closed ports (i.e. Port Knocking), but can involve unusual flags, specific strings, or other unique characteristics. After the sequence is completed, opening a port may be accomplished by the host-based firewall, but could also be implemented by custom software.

Adversaries may also communicate with an already open port, but the service listening on that port will only respond to commands or trigger other malicious functionality if passed the appropriate magic value(s).

The observation of the signal packets to trigger the communication can be conducted through different methods. One means, originally implemented by Cd00r, is to use the libpcap libraries to sniff for the packets in question. Another method leverages raw sockets, which enables the malware to use ports that are already open for use by other programs.

On network devices, adversaries may use crafted packets to enable Network Device Authentication for standard services offered by the device such as telnet. Such signaling may also be used to open a closed service port such as telnet, or to trigger module modification of malware implants on the device, adding, removing, or changing malicious capabilities. Adversaries may use crafted packets to attempt to connect to one or more (open or closed) ports, but may also attempt to connect to a router interface, broadcast, and network address IP on the same port in order to achieve their goals and objectives. To enable this traffic signaling on embedded devices, adversaries must first achieve and leverage Patch System Image due to the monolithic nature of the architecture.

Adversaries may also use the Wake-on-LAN feature to turn on powered off systems. Wake-on-LAN is a hardware feature that allows a powered down system to be powered on, or woken up, by sending a magic packet to it. Once the system is powered on, it may become a target for lateral movement.

Platforms
Linux · macOS · Network Devices · Windows
Telemetry
WinEventLog:SysmonWinEventLog:Microsoft-Windows-Windows Firewall With Advanced Security/FirewallWinEventLog:PowerShellauditd:SYSCALLNSM:Flowmacos:unifiedlognetworkdevice:syslog

How MITRE says to detect it DET0524

Traffic Signaling (Port-knock / magic-packet → firewall or service activation) – T1205

Windows Analytic 1448

A remote host sends a short sequence of failed connection attempts (RST/ICMP unreachable) to a set of closed ports. Within a brief window the endpoint (a) adds/enables a firewall rule or (b) a sniffer-backed process begins listening or opens a new socket, after which a successful connection occurs. Also detects Wake-on-LAN magic packets seen on local segment.

  • WinEventLog:Sysmon EventCode=1
  • WinEventLog:Sysmon EventCode=3, 22
  • WinEventLog:Microsoft-Windows-Windows Firewall With Advanced Security/Firewall EventCode=2004, 2005, 2006
  • WinEventLog:PowerShell EventCode=4103, 4104, 4105, 4106

Linux Analytic 1449

Closed-port knock sequence from a remote IP followed by on-host firewall change (iptables/nftables) or daemon starts listening (socket open) and a successful TCP/UDP connect. Optional detection of libpcap/raw-socket sniffers spawning to watch for secret values.

  • auditd:SYSCALL execve: Commands altering firewall or enabling listeners (iptables, nft, ufw, firewall-cmd, systemctl start *ssh*/*telnet*, ip route add, tcpdump, tshark)
  • auditd:SYSCALL socket/bind: Process binds to a new local port shortly after knock
  • NSM:Flow Knock pattern: multiple REJ/S0 to distinct closed ports then successful connection to service_port
  • NSM:Flow Packets with unusual flags or payloads outside established flows (e.g., WoL magic FF×6 + 16×MAC)

macOS Analytic 1450

Remote knock sequence followed by PF/socketfilterfw rule update or a background process listening on a new port; then a successful TCP session. Also flags WoL magic packets on local segment.

  • macos:unifiedlog exec: Execution of /sbin/pfctl, /usr/libexec/ApplicationFirewall/socketfilterfw, ifconfig, tcpdump, npcap/libpcap consumers
  • macos:unifiedlog Firewall rule enable/disable or listen socket changes
  • NSM:Flow Closed-port hits followed by success from same src_ip

Network Devices Analytic 1451

Crafted ‘synful knock’ patterns toward routers/switches (same src hits interface/broadcast/network address on same port in short order) followed by ACL/telnet/SSH enablement or module change. Detect device image/ACL updates then a new mgmt session.

  • networkdevice:syslog Config/ACL/line vty changes, service enable (telnet/ssh/http(s)), module reloads
  • NSM:Flow Port-knock pattern from one src to device unicast,broadcast,network addresses on same port within TimeWindowKnock

View on attack.mitre.org ↗

Sub-techniques with coverage

Counted in the 9 above — a rule tagged a sub-technique covers this technique too.

chainguard-dev/osquery-defense-kit

3 rules · 2 families
Detection Severity Format
Find root-run processes which link against libpcap 2 variants Undefined osquery SQL
Find root-run processes which link against libpcap 2 variants Undefined osquery SQL
Find root-run processes which link against libpf Undefined osquery SQL

Emerging Threats Open

2 rules
Detection Severity Format
ET ADWARE_PUP Niagara Software Update Check Informational Suricata
ET HUNTING Javascript Mobile Device Check Informational Suricata

socfortress/Wazuh-Rules

2 rules · 1 family
Detection Severity Format
Potential rootkit activity: insmod command executed 2 variants Medium Wazuh XML
Potential rootkit activity: insmod command executed 2 variants Medium Wazuh XML

elastic/detection-rules

1 rule
Detection Severity Format
Unusual Linux Network Port Activity Low Elastic TOML

falcosecurity/rules

1 rule
Detection Severity Format
Unexpected K8s NodePort Connection Low Falco YAML

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.