MITRE ATT&CKtechnique

T1509 Non-Standard Port

Published 2019-08-01 Modified 2025-10-24 Official page ↗
Domain
mobile
Tactics
Command And Control
Platforms
Android, iOS
Version
2.1
Created
2019-08-01

Description

Adversaries may generate network traffic using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088 or port 587 as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.

Related

Tactic · MITRE ATT&CK (1)

  • TA0037 Command and Control tactic

Referenced by MITRE ATT&CK · uses (8)

  • S1185 LightSpy software (malware)
  • S1083 Chameleon software (malware)
  • S0539 Red Alert 2.0 software (malware)
  • S0485 Mandrake software (malware)
  • S0480 Cerberus software (malware)
  • S0463 INSOMNIA software (malware)
  • S0408 FlexiSpy software (tool)
  • S0405 Exodus software (malware)