1. Home
  2. ATT&CK Techniques
  3. T1571 Non-Standard Port

T1571 Non-Standard Port

Adversaries may communicate using a protocol and port paring that are typically not associated. For example, HTTPS over port 8088(Citation: Symantec Elfin Mar 2019) or port 587(Citation: Fortinet Agent Tesla April 2018) as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.

View in MITRE ATT&CK®

NIST 800-53 Mappings

Capability ID Capability Description Mapping Type ATT&CK ID ATT&CK Name Notes
AC-4 Information Flow Enforcement Protects T1571 Non-Standard Port
CA-7 Continuous Monitoring Protects T1571 Non-Standard Port
CM-2 Baseline Configuration Protects T1571 Non-Standard Port
CM-6 Configuration Settings Protects T1571 Non-Standard Port
CM-7 Least Functionality Protects T1571 Non-Standard Port
SC-7 Boundary Protection Protects T1571 Non-Standard Port
SI-3 Malicious Code Protection Protects T1571 Non-Standard Port
SI-4 System Monitoring Protects T1571 Non-Standard Port

Azure Mappings

Capability ID Capability Description Mapping Type ATT&CK ID ATT&CK Name Notes
network_security_groups Network Security Groups technique_scores T1571 Non-Standard Port
Comments
This control can restrict traffic to standard ports and protocols.
References
  1. https://docs.microsoft.com/en-us/azure/virtual-network/network-security-groups-overview
  2. https://docs.microsoft.com/en-us/azure/virtual-network/network-security-group-how-it-works
  3. https://docs.microsoft.com/en-us/azure/security-center/security-center-adaptive-network-hardening
azure_firewall Azure Firewall technique_scores T1571 Non-Standard Port
Comments
This control can limit access to the minimum required ports and therefore protect against adversaries attempting to use non-standard ports for C2 traffic.
References
  1. https://docs.microsoft.com/en-us/azure/firewall/overview
azure_network_traffic_analytics Azure Network Traffic Analytics technique_scores T1571 Non-Standard Port
Comments
This control can identify anomalous traffic that utilizes non-standard application ports.
References
  1. https://docs.microsoft.com/en-us/azure/network-watcher/traffic-analytics