Non-Standard Port

Adversaries may communicate using a protocol and port pairing that are typically not associated (for example, HTTPS over port 8088¹ or port 587² as opposed to the traditional port 443). Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data. Adversaries may also make changes to victim systems to abuse non-standard ports. For example, Registry keys and other configuration settings can be used to modify protocol and port pairings.³

1. Symantec Elfin Mar 2019
2. Fortinet Agent Tesla April 2018
3. change_rdp_port_conti

使用该技术的组织

断言

尚无指向该技术的公开断言。

记录自动入库·未人工复核；置信度与有效期按引用读取。