MITRE ATT&CK - Техника Нестандартный порт

Куда я попал?

SECURITM это SGRC система, автоматизирующая процессы в службах информационной безопасности. SECURITM помогает построить и управлять ИСПДн, КИИ, ГИС, СМИБ/СУИБ, банковскими системами защиты.
А еще SECURITM это место для обмена опытом и наработками для служб безопасности.

Подробнее

Наш канал

Нестандартный порт

Adversaries may communicate using a protocol and port paring that are typically not associated. For example, HTTPS over port 8088(Citation: Symantec Elfin Mar 2019) or port 587(Citation: Fortinet Agent Tesla April 2018) as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.

ID: T1571

Тактика(-и): Command and Control

Платформы: Linux, macOS, Windows

Источники данных: Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow

Версия: 1.0

Дата создания: 14 Mar 2020

Последнее изменение: 26 Mar 2020

Название	Описание
Примеры процедур
WIRTE	WIRTE has used HTTPS over ports 2083 and 2087 for C2.(Citation: Kaspersky WIRTE November 2021)
Silence	Silence has used port 444 when sending data about the system from the client to the server.(Citation: Group IB Silence Sept 2018)
PingPull	PingPull can use HTTPS over port 8080 for C2.(Citation: Unit 42 PingPull Jun 2022)
Emotet	Emotet has used HTTP over ports such as 20, 22, 7080, and 50000, in addition to using ports commonly associated with HTTP/S.(Citation: Talos Emotet Jan 2019)
StrongPity	StrongPity has used HTTPS over port 1402 in C2 communication.(Citation: Bitdefender StrongPity June 2020)
PoetRAT	PoetRAT used TLS to encrypt communications over port 143(Citation: Talos PoetRAT April 2020)
GoldenSpy	GoldenSpy has used HTTP over ports 9005 and 9006 for network traffic, 9002 for C2 requests, 33666 as a WebSocket, and 8090 to download files.(Citation: Trustwave GoldenSpy June 2020)
SUGARUSH	SUGARUSH has used port 4585 for a TCP connection to its C2.(Citation: Mandiant UNC3890 Aug 2022)
	During Operation Wocao, the threat actors used uncommon high ports for its backdoor C2, including ports 25667 and 470000.(Citation: FoxIT Wocao December 2019)
WellMail	WellMail has been observed using TCP port 25, without using SMTP, to leverage an open port for secure command and control communications.(Citation: CISA WellMail July 2020)(Citation: NCSC APT29 July 2020)
HOPLIGHT	HOPLIGHT has connected outbound over TCP port 443 with a FakeTLS method.(Citation: US-CERT HOPLIGHT Apr 2019)
ZxShell	ZxShell can use ports 1985 and 1986 in HTTP/S communication.(Citation: Talos ZxShell Oct 2014)
MoonWind	MoonWind communicates over ports 80, 443, 53, and 8080 via raw sockets instead of the protocols usually associated with the ports.(Citation: Palo Alto MoonWind March 2017)
APT32	An APT32 backdoor can use HTTP over a non-standard TCP port (e.g 14146) which is specified in the backdoor configuration.(Citation: ESET OceanLotus Mar 2019)
HARDRAIN	HARDRAIN binds and listens on port 443 with a FakeTLS method.(Citation: US-CERT HARDRAIN March 2018)
Metamorfo	Metamorfo has communicated with hosts over raw TCP on port 9999.(Citation: FireEye Metamorfo Apr 2018)
BendyBear	BendyBear has used a custom RC4 and XOR encrypted protocol over port 443 for C2.(Citation: Unit42 BendyBear Feb 2021)
Sandworm Team	Sandworm Team has used port 6789 to accept connections on the group's SSH server.(Citation: ESET BlackEnergy Jan 2016)
TEMP.Veles	TEMP.Veles has used port-protocol mismatches on ports such as 443, 4444, 8531, and 50501 during C2.(Citation: FireEye TRITON 2019)
Lazarus Group	Some Lazarus Group malware uses a list of ordered port numbers to choose a port for C2 traffic, creating port-protocol mismatches.(Citation: Novetta Blockbuster)(Citation: Novetta Blockbuster RATs)
njRAT	njRAT has used port 1177 for HTTP C2 communications.(Citation: Trend Micro njRAT 2018)
FIN7	FIN7 has used port-protocol mismatches on ports such as 53, 80, 443, and 8080 during C2.(Citation: FireEye FIN7 Aug 2018)
MacMa	MacMa has used TCP port 5633 for C2 Communication.(Citation: ESET DazzleSpy Jan 2022)
Derusbi	Derusbi has used unencrypted HTTP on port 443 for C2.(Citation: Fidelis Turbo)
RTM	RTM used Port 44443 for its VNC module.(Citation: ESET RTM Feb 2017)
Magic Hound	Magic Hound malware has communicated with its C2 server over TCP port 4443 using HTTP.(Citation: Unit 42 Magic Hound Feb 2017)
TrickBot	Some TrickBot samples have used HTTP over ports 447 and 8082 for C2.(Citation: S2 Grupo TrickBot June 2017)(Citation: Fidelis TrickBot Oct 2016)(Citation: Trend Micro Totbrick Oct 2016) Newer versions of TrickBot have been known to use a custom communication protocol which sends the data unencrypted over port 443. (Citation: Bitdefender Trickbot VNC module Whitepaper 2021)
QuasarRAT	QuasarRAT can use port 4782 on the compromised host for TCP callbacks.(Citation: CISA AR18-352A Quasar RAT December 2018)
BADCALL	BADCALL communicates on ports 443 and 8000 with a FakeTLS method.(Citation: US-CERT BADCALL)
DarkVishnya	DarkVishnya used ports 5190 and 7900 for shellcode listeners, and 4444, 4445, 31337 for shellcode C2.(Citation: Securelist DarkVishnya Dec 2018)
TYPEFRAME	TYPEFRAME has used ports 443, 8080, and 8443 with a FakeTLS method.(Citation: US-CERT TYPEFRAME June 2018)
APT-C-36	APT-C-36 has used port 4050 for C2 communications.(Citation: QiAnXin APT-C-36 Feb2019)
GravityRAT	GravityRAT has used HTTP over a non-standard port, such as TCP port 46769.(Citation: Talos GravityRAT)
APT33	APT33 has used HTTP over TCP ports 808 and 880 for command and control.(Citation: Symantec Elfin Mar 2019)
Bankshot	Bankshot binds and listens on port 1058 for HTTP traffic while also utilizing a FakeTLS method.(Citation: US-CERT Bankshot Dec 2017)
RedLeaves	RedLeaves can use HTTP over non-standard ports, such as 995, for C2.(Citation: PWC Cloud Hopper Technical Annex April 2017)
Cyclops Blink	Cyclops Blink can use non-standard ports for C2 not typically associated with HTTP or HTTPS traffic.(Citation: NCSC Cyclops Blink February 2022)
Rocke	Rocke's miner connects to a C2 server using port 51640.(Citation: Anomali Rocke March 2019)

Контрмера	Описание
Контрмеры
Network Segmentation	Architect sections of the network to isolate critical systems, functions, or resources. Use physical and logical segmentation to prevent access to potentially sensitive systems and information. Use a DMZ to contain any internet-facing services that should not be exposed from the internal network. Configure separate virtual private cloud (VPC) instances to isolate critical cloud systems.
Network Intrusion Prevention	Use intrusion detection signatures to block traffic at network boundaries.

Обнаружение

Analyze packet contents to detect communications that do not follow the expected protocol behavior for the port that is being used. Analyze network data for uncommon data flows (e.g., a client sending significantly more data than it receives from a server). Processes utilizing the network that do not normally have network communication or have never been seen before are suspicious.(Citation: University of Birmingham C2)

Ссылки

Связанные риски

Ничего не найдено

Каталоги

Мы используем cookie-файлы, чтобы получить статистику, которая помогает нам улучшить сервис для вас с целью персонализации сервисов и предложений. Вы может прочитать подробнее о cookie-файлах или изменить настройки браузера. Продолжая пользоваться сайтом, вы даёте согласие на использование ваших cookie-файлов и соглашаетесь с Политикой обработки персональных данных.

Нестандартный порт

Примеры процедур

Контрмеры

Обнаружение

Ссылки

Связанные риски

Каталоги