{"id":"adf876b3-f1f8-4aa9-a4e4-a64106feec06","title":"Testing Usage of Uncommonly Used Port","description":"Adversaries may communicate using a protocol and port paring that are typically not associated.\nFor example, HTTPS over port 8088(Citation: Symantec Elfin Mar 2019) or port 587(Citation: Fortinet Agent Tesla April 2018) as opposed to the traditional port 443.\n","author":"frack113","status":"test","level":"medium","date":"2022-01-23","modified":"","tags":["attack.command-and-control","attack.t1571"],"technique_ids":["T1571"],"logsource":{"product":"windows","category":"ps_script","definition":"Requirements: Script Block Logging must be enabled"},"falsepositives":["Legitimate administrative script"],"references":["https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1571/T1571.md#atomic-test-1---testing-usage-of-uncommonly-used-port-with-powershell","https://learn.microsoft.com/en-us/powershell/module/nettcpip/test-netconnection?view=windowsserver2022-ps"],"source_path":"rules/windows/powershell/powershell_script/posh_ps_test_netconnection.yml","source_sha256":"8febac78f91b06c8296e3aee6afd31107533dac0c7017935b1d0b226a174f93c","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/powershell/powershell_script/posh_ps_test_netconnection.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Testing Usage of Uncommonly Used Port\nid: adf876b3-f1f8-4aa9-a4e4-a64106feec06\nstatus: test\ndescription: |\n    Adversaries may communicate using a protocol and port paring that are typically not associated.\n    For example, HTTPS over port 8088(Citation: Symantec Elfin Mar 2019) or port 587(Citation: Fortinet Agent Tesla April 2018) as opposed to the traditional port 443.\nreferences:\n    - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1571/T1571.md#atomic-test-1---testing-usage-of-uncommonly-used-port-with-powershell\n    - https://learn.microsoft.com/en-us/powershell/module/nettcpip/test-netconnection?view=windowsserver2022-ps\nauthor: frack113\ndate: 2022-01-23\ntags:\n    - attack.command-and-control\n    - attack.t1571\nlogsource:\n    product: windows\n    category: ps_script\n    definition: 'Requirements: Script Block Logging must be enabled'\ndetection:\n    selection:\n        ScriptBlockText|contains|all:\n            - Test-NetConnection\n            - '-ComputerName '\n            - '-port '\n    filter:\n        ScriptBlockText|contains:\n            - ' 443 '\n            - ' 80 '\n    condition: selection and not filter\nfalsepositives:\n    - Legitimate administrative script\nlevel: medium\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1571","id":"T1571","name":"Non-Standard Port","page":"techniques/enterprise/T1571/"}],"data_path":"data/detection-rules/adf876b3-f1f8-4aa9-a4e4-a64106feec06.json","kind":"sigma"}