T1571 Non-Standard Port

High-Level Description

Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088 or port 587 as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.

Adversaries may also make changes to victim systems to abuse non-standard ports. For example, Registry keys and other configuration settings can be used to modify protocol and port pairings.

Kill Chain Phase

• Command and Control (TA0011)

Platforms: ESXi, Linux, macOS, Windows

What to Check

• ] Identify if Non-Standard Port technique is applicable to target environment
• ] Check ESXi systems for indicators of Non-Standard Port
• ] Check Linux systems for indicators of Non-Standard Port
• ] Check macOS systems for indicators of Non-Standard Port
• ] Verify mitigations are bypassed or absent (2 known mitigations)
• ] Assess detection coverage (1 detection strategies)

How to Test

Atomic Red Team Tests

The following tests are from Atomic Red Team and provide actionable ways to test this technique:

Atomic Test 1: Testing usage of uncommonly used port with PowerShell

Testing uncommonly used port utilizing PowerShell. APT33 has been known to attempt telnet over port 8081. Upon execution, details about the successful port check will be displayed.

Supported Platforms: windows

powershell
Test-NetConnection -ComputerName #{domain} -port #{port}

Atomic Test 2: Testing usage of uncommonly used port

Testing uncommonly used port utilizing telnet.

Supported Platforms: linux, macos

bash
echo quit | telnet #{domain} #{port}
exit 0

Dependencies:

• Requires telnet

Manual Testing

If Atomic Red Team tests are not applicable, manually verify the technique by:

1. Identify Attack Surface: Determine if the target environment is susceptible to Non-Standard Port by examining the target platforms (ESXi, Linux, macOS).

1. Assess Existing Defenses: Review whether mitigations for T1571 are in place. If defenses are absent or misconfigured, this technique may be exploitable.

1. Execute Test: Use tools and methods described in the MITRE ATT&CK page and external references below.

Remediation Guide

M1030 Network Segmentation

Properly configure firewalls and proxies to limit outgoing traffic to only necessary ports for that particular network segment.

M1031 Network Intrusion Prevention

Network intrusion detection and prevention systems that use network signatures to identify traffic for specific adversary malware can be used to mitigate activity at the network level.

Detection

Detection Strategy for Non-Standard Ports

Risk Assessment

| Finding | Severity | Impact | | -------------------------------------- | -------- | ------------------- | | Non-Standard Port technique applicable | Low | Command And Control |

CWE Categories

| CWE ID | Title | | ------- | ---------------------------------- | | CWE-300 | Channel Accessible by Non-Endpoint |

References

• University of Birmingham C2
• Symantec Elfin Mar 2019
• change_rdp_port_conti
• Fortinet Agent Tesla April 2018
• Atomic Red Team - T1571
• MITRE ATT&CK - T1571