MITRE ATT&CKtechnique

T1571 Non-Standard Port

Published 2020-03-14 Modified 2026-09-03 Official page ↗
Domain
enterprise
Tactics
Command And Control
Platforms
ESXi, Linux, macOS, Windows
Version
1.3
Created
2020-03-14

Description

Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088 or port 587 as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data. Adversaries may also make changes to victim systems to abuse non-standard ports. For example, Registry keys and other configuration settings can be used to modify protocol and port pairings.

Related

Tactic · MITRE ATT&CK (1)

  • TA0011 Command and Control tactic

Referenced by MITRE ATT&CK · mitigates (2)

  • M1030 Network Segmentation mitigation
  • M1031 Network Intrusion Prevention mitigation

Referenced by MITRE ATT&CK · uses (68)

  • C0063 2025 Poland Wiper Attacks campaign
  • S9023 HiddenFace software (malware)
  • S9024 SPAWNCHIMERA software (malware)
  • S9010 GlassWorm software (malware)
  • S9001 SystemBC software (malware)
  • G1052 Contagious Interview group
  • S1246 BeaverTail software (malware)
  • S1245 InvisibleFerret software (malware)
  • C0056 RedPenguin campaign
  • C0055 Quad7 Activity campaign
  • S1218 VIRTUALPIE software (malware)
  • S1217 VIRTUALPITA software (malware)
  • S1211 Hannotog software (malware)
  • G1047 Velvet Ant group
  • G1045 Salt Typhoon group
  • C0043 Indian Critical Infrastructure Intrusions campaign
  • G1042 RedEcho group
  • S1155 Covenant software (tool)
  • S1145 Pikabot software (malware)
  • C0035 KV Botnet Activity campaign
  • S1130 Raspberry Robin software (malware)
  • C0032 C0032 campaign
  • S1085 Sardonic software (malware)
  • S1078 RotaJakiro software (malware)
  • C0018 C0018 campaign
  • S1049 SUGARUSH software (malware)
  • C0014 Operation Wocao campaign
  • S1031 PingPull software (malware)
  • G1003 Ember Bear group
  • S1016 MacMa software (malware)
Show all 68 ›

Referenced by Compliance · mitigates (14)

  • CIS-12.2 Establish and Maintain a Secure Network Architecture CIS Safeguard v8.1
  • CIS-12.8 Establish and Maintain Dedicated Computing Resources for All Administrative Work CIS Safeguard v8.1
  • CIS-13.8 Deploy a Network Intrusion Prevention Solution CIS Safeguard v8.1
  • CIS-16.8 Separate Production and Non-Production Systems CIS Safeguard v8.1
  • CIS-4.4 Implement and Manage a Firewall on Servers CIS Safeguard v8.1
  • CIS-4.5 Implement and Manage a Firewall on End-User Devices CIS Safeguard v8.1
  • NIST-AC-4 Information Flow Enforcement NIST 800-53 control
  • NIST-CA-7 Continuous Monitoring NIST 800-53 control
  • NIST-CM-2 Baseline Configuration NIST 800-53 control
  • NIST-CM-6 Configuration Settings NIST 800-53 control
  • NIST-CM-7 Least Functionality NIST 800-53 control
  • NIST-SC-7 Boundary Protection NIST 800-53 control
  • NIST-SI-3 Malicious Code Protection NIST 800-53 control
  • NIST-SI-4 System Monitoring NIST 800-53 control

References