Applied Cybernetics Group
T1571 Non-Standard Port
- Technique
T1571- Tactics
- Command and Control
- Research, 90 days
- 5
- KEV CVEs mapped
- 1
- SigmaHQ rules
- 5
- Elastic, Splunk
- 9
- thrunt rules
- 0
- Upstream
- https://attack.mitre.org/techniques/T1571
MITRE description
Adversaries may communicate using a protocol and port pairing that are typically not associated (for example, HTTPS over port 8088(Citation: Symantec Elfin Mar 2019) or port 587(Citation: Fortinet Agent Tesla April 2018) as opposed to the traditional port 443). Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data. Adversaries may also make changes to victim systems to abuse non-standard ports. For example, Registry keys and other configuration settings can be used to modify protocol and port pairings.(Citation: change_rdp_port_conti)
KEV CVEs mapped to this technique
MITRE CTID maps these KEV CVEs to this technique by hand. They are the actively exploited vulnerabilities behind this technique's KEV signal.
Research citing this technique
Reports and advisories from the last 90 days that cite this technique.
-
2026-10-22Group-IB: Inside SiriusQT: A Seriously Skilled RAT -
2026-10-15Google Threat Intelligence: Investigating Ephemeral Supply Chain Tampering -
2026-10-08Huntress: Threat Actors Exploit Critical AhsayCBS Flaws to Drop Webshells and XMRig Cryptominer -
2026-09-14Group-IB: Smish. Click. Drained: Inside the Smishing Triad’s Phishing Cockpit -
2026-09-03Group-IB: The Outsider Phishing Kit: A Resilient Threat in the Face of Law Enforcement Action
Detection coverage
SigmaHQ community rules
- Potentially Suspicious Malware Callback Communication - Linux (core)
- Suspicious DNS Z Flag Bit Set (core)
- Potentially Suspicious Malware Callback Communication (core)
- Communication To Uncommon Destination Ports (core)
- Testing Usage of Uncommonly Used Port (core)
Elastic and Splunk rules
- Suricata and Elastic Defend Network Correlation (elastic)
- Potential Data Exfiltration Activity to an Unusual Destination Port (elastic)
- Script Interpreter Connection to Non-Standard Port (elastic)
- Suspicious Outbound Network Connection via Unsigned Binary (elastic)
- Unusual Linux Network Port Activity (elastic)
- SMTP to the Internet on Port 26/TCP (elastic)
- Cisco NVM - Outbound Connection to Suspicious Port (splunk)
- Cisco Secure Firewall - Communication Over Suspicious Ports (splunk)
- Cisco Secure Firewall - File Download Over Uncommon Port (splunk)