Куда я попал?

SECURITM это SGRC система, автоматизирующая процессы в службах информационной безопасности. SECURITM помогает построить и управлять ИСПДн, КИИ, ГИС, СМИБ/СУИБ, банковскими системами защиты.
А еще SECURITM это место для обмена опытом и наработками для служб безопасности.

Подробнее

Нестандартный порт

Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088(Citation: Symantec Elfin Mar 2019) or port 587(Citation: Fortinet Agent Tesla April 2018) as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data. Adversaries may also make changes to victim systems to abuse non-standard ports. For example, Registry keys and other configuration settings can be used to modify protocol and port pairings.(Citation: change_rdp_port_conti)

ID: T1571

Тактика(-и): Command and Control

Платформы: ESXi, Linux, macOS, Windows

Источники данных: Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow

Версия: 1.2

Дата создания: 14 Mar 2020

Последнее изменение: 15 Apr 2025

Название	Описание
Примеры процедур
WIRTE	WIRTE has used HTTPS over ports 2083 and 2087 for C2.(Citation: Kaspersky WIRTE November 2021)
Hannotog	Hannotog uses non-standard listening ports, such as UDP 5900, for command and control purposes.(Citation: Symantec Bilbug 2022)
Silence	Silence has used port 444 when sending data about the system from the client to the server.(Citation: Group IB Silence Sept 2018)
PingPull	PingPull can use HTTPS over port 8080 for C2.(Citation: Unit 42 PingPull Jun 2022)
RedEcho	RedEcho has used non-standard ports such as TCP 8080 for HTTP communication.(Citation: RecordedFuture RedEcho 2021)
Emotet	Emotet has used HTTP over ports such as 20, 22, 443, 7080, and 50000, in addition to using ports commonly associated with HTTP/S.(Citation: Talos Emotet Jan 2019)(Citation: Binary Defense Emotes Wi-Fi Spreader)
StrongPity	StrongPity has used HTTPS over port 1402 in C2 communication.(Citation: Bitdefender StrongPity June 2020)
PoetRAT	PoetRAT used TLS to encrypt communications over port 143(Citation: Talos PoetRAT April 2020)
GoldenSpy	GoldenSpy has used HTTP over ports 9005 and 9006 for network traffic, 9002 for C2 requests, 33666 as a WebSocket, and 8090 to download files.(Citation: Trustwave GoldenSpy June 2020)
Covenant	Covenant listeners and controllers can be configured to use non-standard ports.(Citation: Github Covenant)
SUGARUSH	SUGARUSH has used port 4585 for a TCP connection to its C2.(Citation: Mandiant UNC3890 Aug 2022)
Raspberry Robin	Raspberry Robin will communicate via HTTP over port 8080 for command and control traffic.(Citation: RedCanary RaspberryRobin 2022)
	During Operation Wocao, the threat actors used uncommon high ports for its backdoor C2, including ports 25667 and 47000.(Citation: FoxIT Wocao December 2019)
WellMail	WellMail has been observed using TCP port 25, without using SMTP, to leverage an open port for secure command and control communications.(Citation: CISA WellMail July 2020)(Citation: NCSC APT29 July 2020)
HOPLIGHT	HOPLIGHT has connected outbound over TCP port 443 with a FakeTLS method.(Citation: US-CERT HOPLIGHT Apr 2019)
ZxShell	ZxShell can use ports 1985 and 1986 in HTTP/S communication.(Citation: Talos ZxShell Oct 2014)
Ember Bear	Ember Bear has used various non-standard ports for C2 communication.(Citation: CISA GRU29155 2024)
MoonWind	MoonWind communicates over ports 80, 443, 53, and 8080 via raw sockets instead of the protocols usually associated with the ports.(Citation: Palo Alto MoonWind March 2017)
APT32	An APT32 backdoor can use HTTP over a non-standard TCP port (e.g 14146) which is specified in the backdoor configuration.(Citation: ESET OceanLotus Mar 2019)
	During C0018, the threat actors opened a variety of ports, including ports 28035, 32467, 41578, and 46892, to establish RDP connections.(Citation: Costa AvosLocker May 2022)
Velvet Ant	Velvet Ant has used random high number ports for PlugX listeners on victim devices.(Citation: Sygnia VelvetAnt 2024A)
HARDRAIN	HARDRAIN binds and listens on port 443 with a FakeTLS method.(Citation: US-CERT HARDRAIN March 2018)
Pikabot	Pikabot uses non-standard ports, such as 2967, 2223, and others, for HTTPS command and control communication.(Citation: Elastic Pikabot 2024)
OSX_OCEANLOTUS.D	OSX_OCEANLOTUS.D has used a custom binary protocol over TCP port 443 for C2.(Citation: Unit42 OceanLotus 2017)
Metamorfo	Metamorfo has communicated with hosts over raw TCP on port 9999.(Citation: FireEye Metamorfo Apr 2018)
	During the C0032 campaign, TEMP.Veles used port-protocol mismatches on ports such as 443, 4444, 8531, and 50501 during C2.(Citation: FireEye TRITON 2019)
BendyBear	BendyBear has used a custom RC4 and XOR encrypted protocol over port 443 for C2.(Citation: Unit42 BendyBear Feb 2021)
Sandworm Team	Sandworm Team has used port 6789 to accept connections on the group's SSH server.(Citation: ESET BlackEnergy Jan 2016)
TEMP.Veles	TEMP.Veles has used port-protocol mismatches on ports such as 443, 4444, 8531, and 50501 during C2.(Citation: FireEye TRITON 2019)
Lazarus Group	Some Lazarus Group malware uses a list of ordered port numbers to choose a port for C2 traffic, creating port-protocol mismatches.(Citation: Novetta Blockbuster)(Citation: Novetta Blockbuster RATs)
njRAT	njRAT has used port 1177 for HTTP C2 communications.(Citation: Trend Micro njRAT 2018)
FIN7	FIN7 has used port-protocol mismatches on ports such as 53, 80, 443, and 8080 during C2.(Citation: FireEye FIN7 Aug 2018)
Sardonic	Sardonic has the ability to connect with actor-controlled C2 servers using a custom binary protocol over port 443.(Citation: Bitdefender Sardonic Aug 2021)
MacMa	MacMa has used TCP port 5633 for C2 Communication.(Citation: ESET DazzleSpy Jan 2022)
Derusbi	Derusbi has used unencrypted HTTP on port 443 for C2.(Citation: Fidelis Turbo)
RotaJakiro	RotaJakiro uses a custom binary protocol over TCP port 443.(Citation: netlab360 rotajakiro vs oceanlotus)
RTM	RTM used Port 44443 for its VNC module.(Citation: ESET RTM Feb 2017)
Magic Hound	Magic Hound malware has communicated with its C2 server over TCP ports 4443 and 10151 using HTTP.(Citation: Unit 42 Magic Hound Feb 2017)(Citation: DFIR Phosphorus November 2021)
TrickBot	Some TrickBot samples have used HTTP over ports 447 and 8082 for C2.(Citation: S2 Grupo TrickBot June 2017)(Citation: Fidelis TrickBot Oct 2016)(Citation: Trend Micro Totbrick Oct 2016) Newer versions of TrickBot have been known to use a custom communication protocol which sends the data unencrypted over port 443. (Citation: Bitdefender Trickbot VNC module Whitepaper 2021)
QuasarRAT	QuasarRAT can use port 4782 on the compromised host for TCP callbacks.(Citation: CISA AR18-352A Quasar RAT December 2018)
BADCALL	BADCALL communicates on ports 443 and 8000 with a FakeTLS method.(Citation: US-CERT BADCALL)
PlugX	PlugX has used random, high-number, non-standard ports to listen for subsequent actions and C2 activities.(Citation: Sygnia VelvetAnt 2024A)
DarkVishnya	DarkVishnya used ports 5190 and 7900 for shellcode listeners, and 4444, 4445, 31337 for shellcode C2.(Citation: Securelist DarkVishnya Dec 2018)
	During Indian Critical Infrastructure Intrusions, RedEcho used non-standard ports such as TCP 8080 for HTTP communication.(Citation: RecordedFuture RedEcho 2021)
TYPEFRAME	TYPEFRAME has used ports 443, 8080, and 8443 with a FakeTLS method.(Citation: US-CERT TYPEFRAME June 2018)
	KV Botnet Activity generates a random port number greater than 30,000 to serve as the listener for subsequent command and control activity.(Citation: Lumen KVBotnet 2023)
APT-C-36	APT-C-36 has used port 4050 for C2 communications.(Citation: QiAnXin APT-C-36 Feb2019)
GravityRAT	GravityRAT has used HTTP over a non-standard port, such as TCP port 46769.(Citation: Talos GravityRAT)
APT33	APT33 has used HTTP over TCP ports 808 and 880 for command and control.(Citation: Symantec Elfin Mar 2019)
Bankshot	Bankshot binds and listens on port 1058 for HTTP traffic while also utilizing a FakeTLS method.(Citation: US-CERT Bankshot Dec 2017)
RedLeaves	RedLeaves can use HTTP over non-standard ports, such as 995, for C2.(Citation: PWC Cloud Hopper Technical Annex April 2017)
Cyclops Blink	Cyclops Blink can use non-standard ports for C2 not typically associated with HTTP or HTTPS traffic.(Citation: NCSC Cyclops Blink February 2022)
Rocke	Rocke's miner connects to a C2 server using port 51640.(Citation: Anomali Rocke March 2019)

Контрмера	Описание
Контрмеры
Network Segmentation	Network segmentation involves dividing a network into smaller, isolated segments to control and limit the flow of traffic between devices, systems, and applications. By segmenting networks, organizations can reduce the attack surface, restrict lateral movement by adversaries, and protect critical assets from compromise. Effective network segmentation leverages a combination of physical boundaries, logical separation through VLANs, and access control policies enforced by network appliances like firewalls, routers, and cloud-based configurations. This mitigation can be implemented through the following measures: Segment Critical Systems: - Identify and group systems based on their function, sensitivity, and risk. Examples include payment systems, HR databases, production systems, and internet-facing servers. - Use VLANs, firewalls, or routers to enforce logical separation. Implement DMZ for Public-Facing Services: - Host web servers, DNS servers, and email servers in a DMZ to limit their access to internal systems. - Apply strict firewall rules to filter traffic between the DMZ and internal networks. Use Cloud-Based Segmentation: - In cloud environments, use VPCs, subnets, and security groups to isolate applications and enforce traffic rules. - Apply AWS Transit Gateway or Azure VNet peering for controlled connectivity between cloud segments. Apply Microsegmentation for Workloads: - Use software-defined networking (SDN) tools to implement workload-level segmentation and prevent lateral movement. Restrict Traffic with ACLs and Firewalls: - Apply Access Control Lists (ACLs) to network devices to enforce "deny by default" policies. - Use firewalls to restrict both north-south (external-internal) and east-west (internal-internal) traffic. Monitor and Audit Segmented Networks: - Regularly review firewall rules, ACLs, and segmentation policies. - Monitor network flows for anomalies to ensure segmentation is effective. Test Segmentation Effectiveness: - Perform periodic penetration tests to verify that unauthorized access is blocked between network segments.
Network Intrusion Prevention	Use intrusion detection signatures to block traffic at network boundaries.

Обнаружение

Analyze packet contents to detect communications that do not follow the expected protocol behavior for the port that is being used. Analyze network data for uncommon data flows (e.g., a client sending significantly more data than it receives from a server). Processes utilizing the network that do not normally have network communication or have never been seen before are suspicious.(Citation: University of Birmingham C2)

Ссылки

Связанные риски

Ничего не найдено

Каталоги

Мы используем cookie-файлы, чтобы получить статистику, которая помогает нам улучшить сервис для вас с целью персонализации сервисов и предложений. Вы может прочитать подробнее о cookie-файлах или изменить настройки браузера. Продолжая пользоваться сайтом, вы даёте согласие на использование ваших cookie-файлов и соглашаетесь с Политикой обработки персональных данных.

Нестандартный порт

Примеры процедур

Контрмеры

Обнаружение

Ссылки

Связанные риски

Каталоги