T1571Command and Control

Non-Standard Port

Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088 or port 587 as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data. Adversaries may also make changes to victim systems to abuse non-standard ports.…

attack.mitre.org ↗

CVEs1

In 1

Reports0

Detections

5 Sigma rules tagged T1571

Non-Standard PortT15715 general rules

Potentially Suspicious Malware Callback Communicationhightest
Potentially Suspicious Malware Callback Communication - Linuxhightest
Communication To Uncommon Destination Portsmediumtest
Suspicious DNS Z Flag Bit Setmediumtest
Testing Usage of Uncommonly Used Portmediumtest

CVEs linked to Non-Standard Port

1 CVE, by priority. Each link shows its badge.

CVE-2023-38035Ivanti Sentry Authentication Bypass Vulnerability
Ivanti · SentryKEVRansomwarePublic exploitCritical · 9.8T1190Exploit Public-Facing Application T1059Command and Scripting Interpreter+6 more
MITRE CTID mapping of the KEV entry · follow-on activity
>99.9%Top 0.03%
79.9priority