Cross-source coverage

T1571 / ATT&CK

Non-Standard Port

25 rules across 7 sources.

4 deprecated hidden · include

From MITRE ATT&CK 19.2

Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088 or port 587 as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.

Adversaries may also make changes to victim systems to abuse non-standard ports. For example, Registry keys and other configuration settings can be used to modify protocol and port pairings.

Platforms
ESXi · Linux · macOS · Windows
Telemetry
WinEventLog:SecurityWinEventLog:Sysmonauditd:SYSCALLlinux:sysloglinux:osquerymacos:unifiedlogesxi:vpxdesxcli:network

How MITRE says to detect it DET0227

Detection Strategy for Non-Standard Ports

Windows Analytic 0633

Processes initiating outbound connections on uncommon ports or using protocols inconsistent with the assigned port. Correlating process creation with subsequent network connections reveals anomalies such as svchost.exe or Office applications using high, atypical ports.

  • WinEventLog:Security EventCode=5156, 5157
  • WinEventLog:Sysmon EventCode=1

Linux Analytic 0634

Unusual daemons or user processes binding/listening on ports outside of standard ranges, or initiating client connections using mismatched protocol/port pairings.

  • auditd:SYSCALL socket/connect syscalls
  • linux:syslog processes binding to non-standard ports or sshd configured on unexpected port
  • linux:osquery process listening or connecting on non-standard ports

macOS Analytic 0635

Applications making outbound connections on non-standard ports or launchd services bound to ports inconsistent with system baselines.

  • macos:unifiedlog outbound TCP/UDP traffic over unexpected port
  • macos:unifiedlog launchd services binding to non-standard ports

ESXi Analytic 0636

VM services or management daemons communicating on ports not defined by VMware defaults, such as vpxa or hostd processes initiating traffic over high-numbered or unexpected ports.

  • esxi:vpxd ESXi service connections on unexpected ports
  • esxcli:network listening sockets bound to non-standard ports

View on attack.mitre.org ↗

elastic/detection-rules

6 rules
Detection Severity Format
Suspicious Outbound Network Connection via Unsigned Binary High Elastic TOML
Script Interpreter Connection to Non-Standard Port Medium Elastic TOML
Suricata and Elastic Defend Network Correlation Medium Elastic TOML
Potential Data Exfiltration Activity to an Unusual Destination Port Low Elastic TOML
SMTP to the Internet on Port 26/TCP Low Elastic TOML
Unusual Linux Network Port Activity Low Elastic TOML

SigmaHQ/sigma

5 rules
Detection Severity Format
Potentially Suspicious Malware Callback Communication High Sigma
Potentially Suspicious Malware Callback Communication - Linux High Sigma
Communication To Uncommon Destination Ports Medium Sigma
Suspicious DNS Z Flag Bit Set Medium Sigma
Testing Usage of Uncommonly Used Port Medium Sigma

chainguard-dev/osquery-defense-kit

4 rules
Detection Severity Format
Suspicious URL requests by built-in fetching tools (event-based) Undefined osquery SQL
Suspicious URL requests by built-in fetching tools (state-based) Undefined osquery SQL
Unexpected programs listening on a TCP port. Undefined osquery SQL
Unexpected programs listening on a TCP port (state-based). Undefined osquery SQL

splunk/security_content

4 rules
Detection Severity Format
Cisco NVM - Outbound Connection to Suspicious Port Undefined SPL
Cisco Secure Firewall - Communication Over Suspicious Ports Undefined SPL
Cisco Secure Firewall - File Download Over Uncommon Port Undefined SPL
Ollama Abnormal Network Connectivity Undefined SPL

Azure/Azure-Sentinel

2 rules
Detection Severity Format
Fortinet - Beacon pattern detected Low KQL
Detect beacon like pattern based on repetitive time intervals in Wire Data Traffic Undefined KQL

panther-labs/panther-analysis

2 rules
Detection Severity Format
VPC Flow Logs Inbound Port Allowlist High Panther Python
VPC Flow Logs Inbound Port Blocklist High Panther Python

socfortress/Wazuh-Rules

2 rules
Detection Severity Format
Sysmon - Event 1: Process creation · PowerShell Test-NetConnection Unusual Port (T1571) Medium Wazuh XML
Telnet connection to an uncommon/high port (MITRE T1571 - Non-Standard Port) Medium Wazuh XML

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.