Adversaries may communicate using a protocol and port pairing that are typically not associated (for example, HTTPS over port 80881 or port 5872 as opposed to the traditional port 443). Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data. Adversaries may also make changes to victim systems to abuse non-standard ports. For example, Registry keys and other configuration settings can be used to modify protocol and port pairings.3
- Symantec Elfin Mar 2019
- Fortinet Agent Tesla April 2018
- change_rdp_port_conti
Groups using this technique
| Group | Name | Country |
|---|---|---|
| grp_g1042 | RedEcho | — |
| grp_g0105 | DarkVishnya | — |
| grp_g1047 | Velvet Ant | — |
| grp_g0090 | WIRTE | — |
| grp_g0032 | Lazarus Group | DPRK |
| grp_g1045 | Salt Typhoon | — |
| grp_g0064 | APT33 | Iran |
| grp_g1052 | Contagious Interview | — |
| grp_g0069 | MuddyWater | — |
| grp_g0082 | APT38 | DPRK |
| grp_g0091 | Silence | — |
| grp_g0046 | FIN7 | — |
| grp_g0099 | APT-C-36 | — |
| grp_g0047 | Gamaredon Group | Russia |
| grp_g0059 | Magic Hound | Iran |
| grp_g1003 | Ember Bear | Russia |
| grp_g0106 | Rocke | — |
| grp_g0034 | Sandworm Team | Russia |
| grp_g0050 | APT32 | Vietnam |
Claims
No public claim points at this technique yet.
Auto-ingested and not human-reviewed; confidence and validity read by citation.