CyberStack

MITRE ATT&CK / Techniques / T1571

Non-Standard Port

ID
T1571
Tactics
TA0011 Command and Control
Platforms
ESXi, Linux, macOS, Windows
Data sources
Network Connection Creation, Process Creation, Network Traffic Flow, Application Log Content, Network Traffic Content
Source
attack.mitre.org
MITRE last modified
4 Sep 2026

Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088[1] or port 587[2] as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.

Adversaries may also make changes to victim systems to abuse non-standard ports. For example, Registry keys and other configuration settings can be used to modify protocol and port pairings.[3]

Detection

Mitigations (2)

M1030 Network Segmentation

Properly configure firewalls and proxies to limit outgoing traffic to only necessary ports for that particular network segment.

M1031 Network Intrusion Prevention

Network intrusion detection and prevention systems that use network signatures to identify traffic for specific adversary malware can be used to mitigate activity at the network level.

Groups (19)

Software (41)

References

  1. Symantec Elfin Mar 2019
  2. Fortinet Agent Tesla April 2018
  3. change_rdp_port_conti