{"source_checked_on":"2026-10-19","schema_version":1,"key":"enterprise/T1205","id":"T1205","name":"Traffic Signaling","domain":"enterprise","reviewed_on":"2026-09-28","source_url":"https://attack.mitre.org/techniques/T1205","source_file":{"file":"enterprise.json","url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/20664a889568dce884a1dac0ec7b12ae3a199f51/enterprise-attack/enterprise-attack-20.0.json","sha256":"81113ba98afa2928f3dcff62022539f7ce30c315c32e14422f11ff95ce534352","bytes":55271014},"source_object_sha256":"0cb7b72d2abce3a8c770404cfb45f4c03f8d05178b417925b7efdbdf58a7dea8","description":"Adversaries may use traffic signaling to hide open ports or other malicious functionality used for persistence or command and control. Traffic signaling involves the use of a magic value or sequence that must be sent to a system to trigger a special response, such as opening a closed port or executing a malicious task. This may take the form of sending a series of packets with certain characteristics before a port will be opened that the adversary can use for command and control. Usually this series of packets consists of attempted connections to a predefined sequence of closed ports (i.e. [Port Knocking](https://attack.mitre.org/techniques/T1205/001)), but can involve unusual flags, specific strings, or other unique characteristics. After the sequence is completed, opening a port may be accomplished by the host-based firewall, but could also be implemented by custom software.\n\nAdversaries may also communicate with an already open port, but the service listening on that port will only respond to commands or trigger other malicious functionality if passed the appropriate magic value(s).\n\nThe observation of the signal packets to trigger the communication can be conducted through different methods. One means, originally implemented by Cd00r (Citation: Hartrell cd00r 2002), is to use the libpcap libraries to sniff for the packets in question. Another method leverages raw sockets, which enables the malware to use ports that are already open for use by other programs.\n\nOn network devices, adversaries may use crafted packets to enable [Network Device Authentication](https://attack.mitre.org/techniques/T1556/004) for standard services offered by the device such as telnet.  Such signaling may also be used to open a closed service port such as telnet, or to trigger module modification of malware implants on the device, adding, removing, or changing malicious capabilities.  Adversaries may use crafted packets to attempt to connect to one or more (open or closed) ports, but may also attempt to connect to a router interface, broadcast, and network address IP on the same port in order to achieve their goals and objectives.(Citation: Cisco Synful Knock Evolution)(Citation: Mandiant - Synful Knock)(Citation: Cisco Blog Legacy Device Attacks)  To enable this traffic signaling on embedded devices, adversaries must first achieve and leverage [Patch System Image](https://attack.mitre.org/techniques/T1601/001) due to the monolithic nature of the architecture.\n\nAdversaries may also use the Wake-on-LAN feature to turn on powered off systems. Wake-on-LAN is a hardware feature that allows a powered down system to be powered on, or woken up, by sending a magic packet to it. Once the system is powered on, it may become a target for lateral movement.(Citation: Bleeping Computer - Ryuk WoL)(Citation: AMD Magic Packet)","references":[{"source_name":"mitre-attack","url":"https://attack.mitre.org/techniques/T1205","external_id":"T1205"},{"source_name":"Bleeping Computer - Ryuk WoL","description":"Abrams, L. (2021, January 14). Ryuk Ransomware Uses Wake-on-Lan To Encrypt Offline Devices. Retrieved February 11, 2021.","url":"https://www.bleepingcomputer.com/news/security/ryuk-ransomware-uses-wake-on-lan-to-encrypt-offline-devices/"},{"source_name":"AMD Magic Packet","description":"AMD. (1995, November 1). Magic Packet Technical White Paper. Retrieved February 17, 2021.","url":"https://www.amd.com/system/files/TechDocs/20213.pdf"},{"source_name":"Mandiant - Synful Knock","description":"Bill Hau, Tony Lee, Josh Homan. (2015, September 15). SYNful Knock - A Cisco router implant - Part I. Retrieved November 17, 2024.","url":"https://cloud.google.com/blog/topics/threat-intelligence/synful-knock-acis/"},{"source_name":"Cisco Synful Knock Evolution","description":"Graham Holmes. (2015, October 8). Evolution of attacks on Cisco IOS devices. Retrieved October 19, 2020.","url":"https://blogs.cisco.com/security/evolution-of-attacks-on-cisco-ios-devices"},{"source_name":"Hartrell cd00r 2002","description":"Hartrell, Greg. (2002, August). Get a handle on cd00r: The invisible backdoor. Retrieved October 13, 2018.","url":"https://www.giac.org/paper/gcih/342/handle-cd00r-invisible-backdoor/103631"},{"source_name":"Cisco Blog Legacy Device Attacks","description":"Omar Santos. (2020, October 19). Attackers Continue to Target Legacy Devices. Retrieved October 20, 2020.","url":"https://community.cisco.com/t5/security-blogs/attackers-continue-to-target-legacy-devices/ba-p/4169954"}],"platforms":["Linux","macOS","Network Devices","Windows"],"environments":["cloud-hosted-endpoint","network-infrastructure","onprem"],"visibility":"source_mapped","visibility_note":null,"parent":null,"children":[{"key":"enterprise/T1205.001","id":"T1205.001","name":"Port Knocking","page":"techniques/enterprise/T1205.001/"},{"key":"enterprise/T1205.002","id":"T1205.002","name":"Socket Filters","page":"techniques/enterprise/T1205.002/"}],"telemetry":[{"id":"DC0064","name":"Command Execution","page":"telemetry/DC0064/","kind":"attack_component","category":"Script and command execution","description":"Execution of a command and its interpreter or parent context.","collection_focus":"Collect process command lines and relevant shell/interpreter audit; shell history alone is neither complete nor tamper-resistant.","providers":[{"name":"PowerShell Script Block Logging","scope":"Script content via event 4104 when configured; channel depends on PowerShell edition.","source_id":"powershell"},{"name":"Sysmon process events","scope":"Interpreter launch and parent context, not full script content.","source_id":"sysmon"},{"name":"Linux Audit","scope":"execve-family execution context; shell built-ins need additional instrumentation.","source_id":"linux"}],"configuration":["Enable Script Block Logging through the policy/configuration for the installed edition. Forward Microsoft-Windows-PowerShell/Operational for Windows PowerShell, or PowerShellCore/Operational for PowerShell 7.","Retain script-block ID and fragment ordering alongside process creation. Protect access to collected script text; secrets may be included.","On Linux, use narrowly scoped Audit execution rules for the lab account and supported architectures, and retain joined SYSCALL/EXECVE/PATH records."],"configuration_example":null,"required_fields":["interpreter","command_line","actor_uid","session_id"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0064","collector":"illustrative-lab-collector","observation":{"interpreter":"/bin/sh","command_line":"printf LAB_TELEMETRY_CHECK","actor_uid":1000,"session_id":"lab-session-1"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Script content and process command lines are different signals. Logging may be partial, fragmented, filtered or disabled; never assume a command line reveals everything executed.","sources":[{"id":"powershell","title":"Microsoft PowerShell logging on Windows","url":"https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.core/about/about_logging_windows?view=powershell-7.5"},{"id":"sysmon","title":"Microsoft Sysmon events and configuration","url":"https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon"},{"id":"linux","title":"Linux Audit rule configuration","url":"https://www.man7.org/linux/man-pages/man8/auditctl.8.html"}],"association":"attack_component","anomaly_design":"Per host role and principal: rare interpreters, command argument patterns and parent-child sequences. Normalize scripts carefully; obfuscation, administrative automation and missing command lines change visibility."},{"id":"DC0082","name":"Network Connection Creation","page":"telemetry/DC0082/","kind":"attack_component","category":"Endpoint activity","description":"Creation of an endpoint network connection linked to a process.","collection_focus":"Enable scoped Sysmon NetworkConnect (3), disabled by default, or a platform-equivalent process-aware network sensor.","providers":[{"name":"Microsoft Sysmon","scope":"Windows event-based collection; enable the event types needed below.","source_id":"sysmon"},{"name":"Linux Audit","scope":"Linux alternative for supported system-call and file events; different semantics and fields.","source_id":"linux"},{"name":"Apple Endpoint Security clients","scope":"macOS alternative where the subscribed event exists; requires an entitled, approved client, not an iOS collector.","source_id":"apple"}],"configuration":["On a disposable Windows host, review the installed Sysmon schema and current configuration; merge scoped event filters into the existing policy rather than replacing it.","Forward Microsoft-Windows-Sysmon/Operational to the lab collector. Preserve event ID, timestamp, computer, process identifiers and the original event.","For Linux or macOS, select the equivalent sensor separately and test its emitted fields; a Windows event ID does not transfer across platforms."],"configuration_example":null,"required_fields":["process_guid","destination_ip","destination_port","protocol","initiated"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0082","collector":"illustrative-lab-collector","observation":{"process_guid":"lab-process-001","destination_ip":"198.51.100.20","destination_port":443,"protocol":"tcp","initiated":true}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Event filtering and sensor versions change coverage. High-volume image-load and process-access collection needs tuning; endpoint events alone do not establish intent.","sources":[{"id":"sysmon","title":"Microsoft Sysmon events and configuration","url":"https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon"},{"id":"sysmon_config","title":"Microsoft Sysmon configuration files","url":"https://learn.microsoft.com/en-us/windows/security/operating-system-security/sysmon/sysmon-configuration-files"},{"id":"linux","title":"Linux Audit rule configuration","url":"https://www.man7.org/linux/man-pages/man8/auditctl.8.html"},{"id":"apple","title":"Apple Endpoint Security framework for macOS","url":"https://developer.apple.com/documentation/endpointsecurity"},{"id":"process_audit","title":"Microsoft process creation event 4688","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4688"}],"association":"attack_component","anomaly_design":"Per host role and user: rare process/object combinations, bursts of object access or modification, and ordered parent/action sequences. Compare maintenance windows and signed software rollout activity."},{"id":"DC0085","name":"Network Traffic Content","page":"telemetry/DC0085/","kind":"attack_component","category":"Network and protocol telemetry","description":"Packet or decoded application-protocol content visible at a network sensor.","collection_focus":"Scope approved packet capture/protocol content collection to the lab flow; retain capture provenance and truncation indicators.","providers":[{"name":"Zeek","scope":"Connection and protocol metadata from traffic visible to the sensor.","source_id":"zeek"},{"name":"Suricata EVE","scope":"Configured flow, alert, DNS, HTTP, TLS and protocol records.","source_id":"suricata"}],"configuration":["Use an authorized lab TAP/SPAN, virtual mirror or gateway interface. Define which traffic crosses it; avoid assuming visibility into every segment.","Enable the required Zeek analyzers or Suricata EVE event types. Export logs with sensor identity, clock synchronization and flow correlation identifiers.","Monitor capture loss, truncation and exporter sampling. Capture payload only with approval and restrictive retention; encryption normally prevents plaintext inspection."],"configuration_example":null,"required_fields":["flow_id","protocol","method","path","payload_excerpt"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0085","collector":"illustrative-lab-collector","observation":{"flow_id":"lab-flow-1","protocol":"http","method":"GET","path":"/lab-check","payload_excerpt":"LAB_TELEMETRY_CHECK"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Flows are not packet payloads. NAT, asymmetric routes, encryption, missing mirrors and sampling can hide attribution or content. A destination connection alone does not prove malicious intent.","sources":[{"id":"zeek","title":"Zeek protocol and connection logs","url":"https://docs.zeek.org/en/current/reference/logs/index.html"},{"id":"zeek_start","title":"Zeek capture setup","url":"https://docs.zeek.org/en/current/quickstart.html"},{"id":"suricata","title":"Suricata EVE JSON output","url":"https://docs.suricata.io/en/latest/output/eve/eve-json-output.html"}],"association":"attack_component","anomaly_design":"Per source and observation point: connection rate, destination-host/port fan-out, response/failure ratio and previously unseen destinations. Compare equivalent time windows; separate authorized scanners, NAT and sampling effects."},{"id":"DC0078","name":"Network Traffic Flow","page":"telemetry/DC0078/","kind":"attack_component","category":"Network and protocol telemetry","description":"Connection/flow summaries such as endpoints, duration, byte counts and transport.","collection_focus":"Collect Zeek conn.log, Suricata flow events or exporter equivalents, including observation point and sampling settings.","providers":[{"name":"Zeek","scope":"Connection and protocol metadata from traffic visible to the sensor.","source_id":"zeek"},{"name":"Suricata EVE","scope":"Configured flow, alert, DNS, HTTP, TLS and protocol records.","source_id":"suricata"},{"name":"AWS VPC Flow Logs","scope":"IP traffic metadata alternative; no packet payload or DNS answer history, and some traffic is not logged.","source_id":"flow"}],"configuration":["Use an authorized lab TAP/SPAN, virtual mirror or gateway interface. Define which traffic crosses it; avoid assuming visibility into every segment.","Enable the required Zeek analyzers or Suricata EVE event types. Export logs with sensor identity, clock synchronization and flow correlation identifiers.","Monitor capture loss, truncation and exporter sampling. Capture payload only with approval and restrictive retention; encryption normally prevents plaintext inspection."],"configuration_example":null,"required_fields":["source_ip","destination_ip","destination_port","protocol","bytes_sent","bytes_received"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0078","collector":"illustrative-lab-collector","observation":{"source_ip":"192.0.2.10","destination_ip":"198.51.100.20","destination_port":443,"protocol":"tcp","bytes_sent":128,"bytes_received":512}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Flows are not packet payloads. NAT, asymmetric routes, encryption, missing mirrors and sampling can hide attribution or content. A destination connection alone does not prove malicious intent.","sources":[{"id":"zeek","title":"Zeek protocol and connection logs","url":"https://docs.zeek.org/en/current/reference/logs/index.html"},{"id":"zeek_start","title":"Zeek capture setup","url":"https://docs.zeek.org/en/current/quickstart.html"},{"id":"suricata","title":"Suricata EVE JSON output","url":"https://docs.suricata.io/en/latest/output/eve/eve-json-output.html"},{"id":"flow","title":"AWS VPC Flow Logs","url":"https://docs.aws.amazon.com/vpc/latest/userguide/flow-logs.html"}],"association":"attack_component","anomaly_design":"Per source and observation point: connection rate, destination-host/port fan-out, response/failure ratio and previously unseen destinations. Compare equivalent time windows; separate authorized scanners, NAT and sampling effects."},{"id":"DC0032","name":"Process Creation","page":"telemetry/DC0032/","kind":"attack_component","category":"Endpoint activity","description":"Creation of a process with executable, command line, parent and security context.","collection_focus":"Collect Sysmon ProcessCreate (1); preserve ProcessGuid and parent identifiers. Security 4688 is an alternative with separate audit/command-line settings.","providers":[{"name":"Microsoft Sysmon","scope":"Windows event-based collection; enable the event types needed below.","source_id":"sysmon"},{"name":"Linux Audit","scope":"Linux alternative for supported system-call and file events; different semantics and fields.","source_id":"linux"},{"name":"Apple Endpoint Security clients","scope":"macOS alternative where the subscribed event exists; requires an entitled, approved client, not an iOS collector.","source_id":"apple"}],"configuration":["On a disposable Windows host, review the installed Sysmon schema and current configuration; merge scoped event filters into the existing policy rather than replacing it.","Forward Microsoft-Windows-Sysmon/Operational to the lab collector. Preserve event ID, timestamp, computer, process identifiers and the original event.","For Linux or macOS, select the equivalent sensor separately and test its emitted fields; a Windows event ID does not transfer across platforms."],"configuration_example":{"label":"Sysmon filter fragment · merge into the reviewed lab configuration","language":"xml","source_id":"sysmon_config","content":"<EventFiltering>\n  <ProcessCreate onmatch=\"include\">\n    <Image condition=\"is\">C:\\Windows\\System32\\whoami.exe</Image>\n  </ProcessCreate>\n</EventFiltering>","note":"This fragment only selects the named process. It is not a complete production policy. Inspect the installed schema with sysmon64 -s; preserve existing rules, then apply the reviewed complete configuration with sysmon64 -c <configuration-file>."},"required_fields":["process_guid","image","parent_image","command_line","user"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0032","collector":"illustrative-lab-collector","observation":{"process_guid":"lab-process-001","image":"C:\\Windows\\System32\\whoami.exe","parent_image":"C:\\Windows\\System32\\cmd.exe","command_line":"whoami","user":"LAB\\analyst"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Event filtering and sensor versions change coverage. High-volume image-load and process-access collection needs tuning; endpoint events alone do not establish intent.","sources":[{"id":"sysmon","title":"Microsoft Sysmon events and configuration","url":"https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon"},{"id":"sysmon_config","title":"Microsoft Sysmon configuration files","url":"https://learn.microsoft.com/en-us/windows/security/operating-system-security/sysmon/sysmon-configuration-files"},{"id":"linux","title":"Linux Audit rule configuration","url":"https://www.man7.org/linux/man-pages/man8/auditctl.8.html"},{"id":"apple","title":"Apple Endpoint Security framework for macOS","url":"https://developer.apple.com/documentation/endpointsecurity"},{"id":"process_audit","title":"Microsoft process creation event 4688","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4688"}],"association":"attack_component","anomaly_design":"Per host role and user: rare process/object combinations, bursts of object access or modification, and ordered parent/action sequences. Compare maintenance windows and signed software rollout activity."}],"detection":{"key":"enterprise/T1205","id":"T1205","name":"Traffic Signaling","domain":"enterprise","platforms":["Linux","macOS","Network Devices","Windows"],"environments":["cloud-hosted-endpoint","network-infrastructure","onprem"],"source_url":"https://attack.mitre.org/techniques/T1205","technique_page":"techniques/enterprise/T1205/","page":"detections/enterprise/T1205/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":4,"live_validated":0},"sigma_rules":[],"atlas_basic":[],"atlas_anomaly":[],"anomaly_types":[],"strategies":[{"id":"DET0524","name":"Traffic Signaling (Port-knock / magic-packet → firewall or service activation) – T1205","url":"https://attack.mitre.org/detectionstrategies/DET0524","stix_id":"x-mitre-detection-strategy--1e601759-c5d1-45cc-97a1-972967426794","relationship_id":"relationship--b014be93-7f58-428b-9612-069d50c1a9e8","description":"","analytics":[{"id":"AN1448","name":"Analytic 1448","guidance":"A remote host sends a short sequence of failed connection attempts (RST/ICMP unreachable) to a set of closed ports. Within a brief window the endpoint (a) adds/enables a firewall rule or (b) a sniffer-backed process begins listening or opens a new socket, after which a successful connection occurs. Also detects Wake-on-LAN magic packets seen on local segment.","url":"https://attack.mitre.org/detectionstrategies/DET0524#AN1448","platforms":["Windows"],"tuning":[{"field":"TimeWindowKnock","description":"Window to correlate knock sequence → rule change → successful connect (e.g., 120s)."},{"field":"PortSequenceMinLen","description":"Minimum number of distinct closed ports hit before success (e.g., 3)."},{"field":"SuspiciousProcesses","description":"List of binaries that commonly toggle firewall/sniff (netsh.exe, powershell.exe, npcapservice.exe, windivert, rawsock tools)."},{"field":"AllowedFirewallChangers","description":"Service accounts or software update agents allowed to change firewall."},{"field":"WoLAllowedWindows","description":"Maintenance windows when magic packets are expected."}],"log_sources":[{"component_id":"DC0032","component":"Process Creation","name":"WinEventLog:Sysmon","channel":"EventCode=1","platforms":["Windows"],"analytic_id":"AN1448","source_url":"https://attack.mitre.org/detectionstrategies/DET0524#AN1448","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0032/"},{"component_id":"DC0082","component":"Network Connection Creation","name":"WinEventLog:Sysmon","channel":"EventCode=3, 22","platforms":["Windows"],"analytic_id":"AN1448","source_url":"https://attack.mitre.org/detectionstrategies/DET0524#AN1448","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0082/"},{"component_id":"DC0078","component":"Network Traffic Flow","name":"WinEventLog:Microsoft-Windows-Windows Firewall With Advanced Security/Firewall","channel":"EventCode=2004, 2005, 2006","platforms":["Windows"],"analytic_id":"AN1448","source_url":"https://attack.mitre.org/detectionstrategies/DET0524#AN1448","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0078/"},{"component_id":"DC0064","component":"Command Execution","name":"WinEventLog:PowerShell","channel":"EventCode=4103, 4104, 4105, 4106","platforms":["Windows"],"analytic_id":"AN1448","source_url":"https://attack.mitre.org/detectionstrategies/DET0524#AN1448","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0064/"}]},{"id":"AN1449","name":"Analytic 1449","guidance":"Closed-port knock sequence from a remote IP followed by on-host firewall change (iptables/nftables) or daemon starts listening (socket open) and a successful TCP/UDP connect. Optional detection of libpcap/raw-socket sniffers spawning to watch for secret values.","url":"https://attack.mitre.org/detectionstrategies/DET0524#AN1449","platforms":["Linux"],"tuning":[{"field":"ServicePort","description":"Port that becomes available post-knock (e.g., 22/8022/2323)."},{"field":"KnockResetRatio","description":"Percentage of failed attempts with RST/ICMP vs SYN/SYN-ACK to qualify as closed-port probing."},{"field":"ProcessAllowList","description":"Automation expected to touch firewall/daemon configs (config-mgmt agents)."}],"log_sources":[{"component_id":"DC0032","component":"Process Creation","name":"auditd:SYSCALL","channel":"execve: Commands altering firewall or enabling listeners (iptables, nft, ufw, firewall-cmd, systemctl start *ssh*/*telnet*, ip route add, tcpdump, tshark)","platforms":["Linux"],"analytic_id":"AN1449","source_url":"https://attack.mitre.org/detectionstrategies/DET0524#AN1449","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0032/"},{"component_id":"DC0082","component":"Network Connection Creation","name":"auditd:SYSCALL","channel":"socket/bind: Process binds to a new local port shortly after knock","platforms":["Linux"],"analytic_id":"AN1449","source_url":"https://attack.mitre.org/detectionstrategies/DET0524#AN1449","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0082/"},{"component_id":"DC0078","component":"Network Traffic Flow","name":"NSM:Flow","channel":"Knock pattern: multiple REJ/S0 to distinct closed ports then successful connection to service_port","platforms":["Linux"],"analytic_id":"AN1449","source_url":"https://attack.mitre.org/detectionstrategies/DET0524#AN1449","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0078/"},{"component_id":"DC0085","component":"Network Traffic Content","name":"NSM:Flow","channel":"Packets with unusual flags or payloads outside established flows (e.g., WoL magic FF×6 + 16×MAC)","platforms":["Linux"],"analytic_id":"AN1449","source_url":"https://attack.mitre.org/detectionstrategies/DET0524#AN1449","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0085/"}]},{"id":"AN1450","name":"Analytic 1450","guidance":"Remote knock sequence followed by PF/socketfilterfw rule update or a background process listening on a new port; then a successful TCP session. Also flags WoL magic packets on local segment.","url":"https://attack.mitre.org/detectionstrategies/DET0524#AN1450","platforms":["macOS"],"tuning":[{"field":"PFAnchorPaths","description":"Anchors or conf files monitored for change (/etc/pf.conf, /etc/pf.anchors/*)."},{"field":"DeveloperMode","description":"Reduce noise on dev endpoints compiling or testing PF rules."}],"log_sources":[{"component_id":"DC0032","component":"Process Creation","name":"macos:unifiedlog","channel":"exec: Execution of /sbin/pfctl, /usr/libexec/ApplicationFirewall/socketfilterfw, ifconfig, tcpdump, npcap/libpcap consumers","platforms":["macOS"],"analytic_id":"AN1450","source_url":"https://attack.mitre.org/detectionstrategies/DET0524#AN1450","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0032/"},{"component_id":"DC0078","component":"Network Traffic Flow","name":"macos:unifiedlog","channel":"Firewall rule enable/disable or listen socket changes","platforms":["macOS"],"analytic_id":"AN1450","source_url":"https://attack.mitre.org/detectionstrategies/DET0524#AN1450","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0078/"},{"component_id":"DC0082","component":"Network Connection Creation","name":"NSM:Flow","channel":"Closed-port hits followed by success from same src_ip","platforms":["macOS"],"analytic_id":"AN1450","source_url":"https://attack.mitre.org/detectionstrategies/DET0524#AN1450","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0082/"}]},{"id":"AN1451","name":"Analytic 1451","guidance":"Crafted ‘synful knock’ patterns toward routers/switches (same src hits interface/broadcast/network address on same port in short order) followed by ACL/telnet/SSH enablement or module change. Detect device image/ACL updates then a new mgmt session.","url":"https://attack.mitre.org/detectionstrategies/DET0524#AN1451","platforms":["Network Devices"],"tuning":[{"field":"MgmtPortSet","description":"Ports whose sudden enablement should alert (23, 22, 2323, 80/443, 4786)."},{"field":"DeviceRole","description":"Applies different thresholds to core/edge/branch devices."}],"log_sources":[{"component_id":"DC0078","component":"Network Traffic Flow","name":"networkdevice:syslog","channel":"Config/ACL/line vty changes, service enable (telnet/ssh/http(s)), module reloads","platforms":["Network Devices"],"analytic_id":"AN1451","source_url":"https://attack.mitre.org/detectionstrategies/DET0524#AN1451","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0078/"},{"component_id":"DC0082","component":"Network Connection Creation","name":"NSM:Flow","channel":"Port-knock pattern from one src to device unicast,broadcast,network addresses on same port within TimeWindowKnock","platforms":["Network Devices"],"analytic_id":"AN1451","source_url":"https://attack.mitre.org/detectionstrategies/DET0524#AN1451","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0082/"}]}]}],"telemetry_references":[{"id":"DC0064","name":"Command Execution","tag":"Command Execution","page":"telemetry/DC0064/","kind":"attack_component"},{"id":"DC0082","name":"Network Connection Creation","tag":"Network Connection Creation","page":"telemetry/DC0082/","kind":"attack_component"},{"id":"DC0085","name":"Network Traffic Content","tag":"Network Traffic Content","page":"telemetry/DC0085/","kind":"attack_component"},{"id":"DC0078","name":"Network Traffic Flow","tag":"Network Traffic Flow","page":"telemetry/DC0078/","kind":"attack_component"},{"id":"DC0032","name":"Process Creation","tag":"Process Creation","page":"telemetry/DC0032/","kind":"attack_component"}],"visibility":"source_mapped","visibility_note":null,"tool_references":[],"related_parent":null,"article_url":"https://1200km.com/articles/read/2026/2026-04-20-malicious-activity-as-a-statistical-signal-a-detection-engineering-analysis-of-anomaly-bas-90df8b6dea12/","validation":{"source_join":"exact_ids","sigma_yaml":"parsed","backend_compilation":"not_run","live_telemetry":"not_run","detection_execution":"not_run"}},"tools":[],"software":[{"id":"S0022","name":"Uroburos","url":"https://attack.mitre.org/software/S0022","kind":"malware","description":"[Uroburos](https://attack.mitre.org/software/S0022) can intercept the first client to server packet in the 3-way TCP handshake to determine if the packet contains the correct unique value for a specific [Uroburos](https://attack.mitre.org/software/S0022) implant. If the value does not match, the packet and the rest of the TCP session are passed to the legitimate listening application.(Citation: Joint Cybersecurity Advisory AA23-129A Snake Malware May 2023)","relationship_id":"relationship--d71ad22f-7e01-4140-9080-bce4ae880880","references":[{"source_name":"Joint Cybersecurity Advisory AA23-129A Snake Malware May 2023","description":"FBI et al. (2023, May 9). Hunting Russian Intelligence “Snake” Malware. Retrieved June 8, 2023.","url":"https://www.cisa.gov/sites/default/files/2023-05/aa23-129a_snake_malware_2.pdf"}]},{"id":"S0220","name":"Chaos","url":"https://attack.mitre.org/software/S0220","kind":"malware","description":"[Chaos](https://attack.mitre.org/software/S0220) provides a reverse shell is triggered upon receipt of a packet with a special string, sent to any port.(Citation: Chaos Stolen Backdoor)","relationship_id":"relationship--788ec1d9-9192-46c9-8bc3-7397ccb854df","references":[{"source_name":"Chaos Stolen Backdoor","description":"Sebastian Feldmann. (2018, February 14). Chaos: a Stolen Backdoor Rising Again. Retrieved March 5, 2018.","url":"http://gosecure.net/2018/02/14/chaos-stolen-backdoor-rising/"}]},{"id":"S0221","name":"Umbreon","url":"https://attack.mitre.org/software/S0221","kind":"malware","description":"[Umbreon](https://attack.mitre.org/software/S0221) provides additional access using its backdoor Espeon, providing a reverse shell upon receipt of a special packet.(Citation: Umbreon Trend Micro)","relationship_id":"relationship--85af8200-2e4c-4253-a334-0390ac4065f8","references":[{"source_name":"Umbreon Trend Micro","description":"Fernando Mercês. (2016, September 5). Pokémon-themed Umbreon Linux Rootkit Hits x86, ARM Systems. Retrieved March 5, 2018.","url":"https://blog.trendmicro.com/trendlabs-security-intelligence/pokemon-themed-umbreon-linux-rootkit-hits-x86-arm-systems/?_ga=2.180041126.367598458.1505420282-1759340220.1502477046"}]},{"id":"S0430","name":"Winnti for Linux","url":"https://attack.mitre.org/software/S0430","kind":"malware","description":"[Winnti for Linux](https://attack.mitre.org/software/S0430) has used a passive listener, capable of identifying a specific magic value before executing tasking, as a secondary command and control (C2) mechanism.(Citation: Chronicle Winnti for Linux May 2019)","relationship_id":"relationship--76625152-3f62-4a1e-a769-5503811b0276","references":[{"source_name":"Chronicle Winnti for Linux May 2019","description":"Chronicle Blog. (2019, May 15). Winnti: More than just Windows and Gates. Retrieved April 29, 2020.","url":"https://medium.com/chronicle-blog/winnti-more-than-just-windows-and-gates-e4f03436031a"}]},{"id":"S0446","name":"Ryuk","url":"https://attack.mitre.org/software/S0446","kind":"malware","description":"[Ryuk](https://attack.mitre.org/software/S0446) has used Wake-on-Lan to power on turned off systems for lateral movement.(Citation: Bleeping Computer - Ryuk WoL)","relationship_id":"relationship--9fb463af-4ad8-48b5-89cf-68bac34a68d7","references":[{"source_name":"Bleeping Computer - Ryuk WoL","description":"Abrams, L. (2021, January 14). Ryuk Ransomware Uses Wake-on-Lan To Encrypt Offline Devices. Retrieved February 11, 2021.","url":"https://www.bleepingcomputer.com/news/security/ryuk-ransomware-uses-wake-on-lan-to-encrypt-offline-devices/"}]},{"id":"S0519","name":"SYNful Knock","url":"https://attack.mitre.org/software/S0519","kind":"malware","description":"[SYNful Knock](https://attack.mitre.org/software/S0519) can be sent instructions via special packets to change its functionality. Code for new functionality can be included in these messages.(Citation: Mandiant - Synful Knock)","relationship_id":"relationship--5d9b14c3-70ea-46b3-9b0d-1595c215efec","references":[{"source_name":"Mandiant - Synful Knock","description":"Bill Hau, Tony Lee, Josh Homan. (2015, September 15). SYNful Knock - A Cisco router implant - Part I. Retrieved November 17, 2024.","url":"https://cloud.google.com/blog/topics/threat-intelligence/synful-knock-acis/"}]},{"id":"S0587","name":"Penquin","url":"https://attack.mitre.org/software/S0587","kind":"malware","description":"[Penquin](https://attack.mitre.org/software/S0587) will connect to C2 only after sniffing a \"magic packet\" value in TCP or UDP packets matching specific conditions.(Citation: Leonardo Turla Penquin May 2020)(Citation: Kaspersky Turla Penquin December 2014)","relationship_id":"relationship--5488dd31-2a28-4250-89ff-963214f46b92","references":[{"source_name":"Kaspersky Turla Penquin December 2014","description":"Baumgartner, K. and Raiu, C. (2014, December 8). The ‘Penquin’ Turla. Retrieved March 11, 2021.","url":"https://securelist.com/the-penquin-turla-2/67962/"},{"source_name":"Leonardo Turla Penquin May 2020","description":"Leonardo. (2020, May 29). MALWARE TECHNICAL INSIGHT TURLA “Penquin_x64”. Retrieved March 11, 2021.","url":"https://www.leonardo.com/documents/20142/10868623/Malware+Technical+Insight+_Turla+%E2%80%9CPenquin_x64%E2%80%9D.pdf"}]},{"id":"S0641","name":"Kobalos","url":"https://attack.mitre.org/software/S0641","kind":"malware","description":"[Kobalos](https://attack.mitre.org/software/S0641) is triggered by an incoming TCP connection to a legitimate service from a specific source port.(Citation: ESET Kobalos Feb 2021)(Citation: ESET Kobalos Jan 2021) ","relationship_id":"relationship--894e96b2-2dac-4958-8f14-8eacf169b9b6","references":[{"source_name":"ESET Kobalos Feb 2021","description":"M.Leveille, M., Sanmillan, I. (2021, February 2). Kobalos – A complex Linux threat to high performance computing infrastructure. Retrieved August 24, 2021.","url":"https://www.welivesecurity.com/2021/02/02/kobalos-complex-linux-threat-high-performance-computing-infrastructure/"},{"source_name":"ESET Kobalos Jan 2021","description":"M.Leveille, M., Sanmillan, I. (2021, January). A WILD KOBALOS APPEARS Tricksy Linux malware goes after HPCs. Retrieved August 24, 2021.","url":"https://www.welivesecurity.com/wp-content/uploads/2021/01/ESET_Kobalos.pdf"}]},{"id":"S0664","name":"Pandora","url":"https://attack.mitre.org/software/S0664","kind":"malware","description":"[Pandora](https://attack.mitre.org/software/S0664) can identify if incoming HTTP traffic contains a token and if so it will intercept the traffic and process the received command.(Citation: Trend Micro Iron Tiger April 2021)","relationship_id":"relationship--8f27fb1d-f888-4167-a08c-781dde29755d","references":[{"source_name":"Trend Micro Iron Tiger April 2021","description":"Lunghi, D. and Lu, K. (2021, April 9). Iron Tiger APT Updates Toolkit With Evolved SysUpdate Malware. Retrieved November 12, 2021.","url":"https://www.trendmicro.com/en_us/research/21/d/iron-tiger-apt-updates-toolkit-with-evolved-sysupdate-malware-va.html"}]},{"id":"S1114","name":"ZIPLINE","url":"https://attack.mitre.org/software/S1114","kind":"malware","description":"[ZIPLINE](https://attack.mitre.org/software/S1114) can identify a specific string in intercepted network traffic, `SSH-2.0-OpenSSH_0.3xx.`, to trigger its command functionality.(Citation: Mandiant Cutting Edge January 2024)","relationship_id":"relationship--27611566-a11a-4e43-96be-a221878cbf23","references":[{"source_name":"Mandiant Cutting Edge January 2024","description":"McLellan, T. et al. (2024, January 12). Cutting Edge: Suspected APT Targets Ivanti Connect Secure VPN in New Zero-Day Exploitation. Retrieved February 27, 2024.","url":"https://www.mandiant.com/resources/blog/suspected-apt-targets-ivanti-zero-day"}]},{"id":"S1118","name":"BUSHWALK","url":"https://attack.mitre.org/software/S1118","kind":"malware","description":"[BUSHWALK](https://attack.mitre.org/software/S1118) can modify the `DSUserAgentCap.pm` Perl module on Ivanti Connect Secure VPNs and either activate or deactivate depending on the value of the user agent in incoming HTTP requests.(Citation: Mandiant Cutting Edge Part 3 February 2024)","relationship_id":"relationship--291e3bfc-90e7-44ac-828c-8bbf7b36431c","references":[{"source_name":"Mandiant Cutting Edge Part 3 February 2024","description":"Lin, M. et al. (2024, February 27). Cutting Edge, Part 3: Investigating Ivanti Connect Secure VPN Exploitation and Persistence Attempts. Retrieved March 1, 2024.","url":"https://www.mandiant.com/resources/blog/investigating-ivanti-exploitation-persistence"}]},{"id":"S1201","name":"TRANSLATEXT","url":"https://attack.mitre.org/software/S1201","kind":"malware","description":"[TRANSLATEXT](https://attack.mitre.org/software/S1201) has redirected clients to legitimate Gmail, Naver or Kakao pages if the clients connect with no parameters.(Citation: Zscaler Kimsuky TRANSLATEXT) ","relationship_id":"relationship--d3f8f346-d5a7-4a3a-ad15-ea872e12781e","references":[{"source_name":"Zscaler Kimsuky TRANSLATEXT","description":"Park, S. (2024, June 27). Kimsuky deploys TRANSLATEXT to target South Korean academia. Retrieved October 14, 2024.","url":"https://www.zscaler.com/blogs/security-research/kimsuky-deploys-translatext-target-south-korean-academia#technical-analysis"}]},{"id":"S1203","name":"J-magic","url":"https://attack.mitre.org/software/S1203","kind":"malware","description":"[J-magic](https://attack.mitre.org/software/S1203) can monitor TCP traffic for packets containing one of five different predefined parameters and will spawn a reverse shell if one of the parameters and the proper response string to a subsequent challenge is received.(Citation: Lumen J-Magic JAN 2025)","relationship_id":"relationship--b3bd6363-e6dc-4c4a-ac41-2091127e1860","references":[{"source_name":"Lumen J-Magic JAN 2025","description":"Black Lotus Labs. (2025, January 23). The J-Magic Show: Magic Packets and Where to find them. Retrieved February 17, 2025.","url":"https://blog.lumen.com/the-j-magic-show-magic-packets-and-where-to-find-them/"}]},{"id":"S1219","name":"REPTILE","url":"https://attack.mitre.org/software/S1219","kind":"malware","description":"The [REPTILE](https://attack.mitre.org/software/S1219) reverse shell component can listen for a specialized packet in TCP, UDP, or ICMP for activation.(Citation: Google Cloud Mandiant UNC3886 2024)(Citation: Mandiant Fortinet Zero Day)","relationship_id":"relationship--a0a94b9a-a81f-4ca6-b98c-f81291402f61","references":[{"source_name":"Google Cloud Mandiant UNC3886 2024","description":" Punsaen Boonyakarn, Shawn Chew, Logeswaran Nadarajan, Mathew Potaczek, Jakub Jozwiak, and Alex Marvi. (2024, June 18). Cloaked and Covert: Uncovering UNC3886 Espionage Operations. Retrieved September 24, 2024.","url":"https://cloud.google.com/blog/topics/threat-intelligence/uncovering-unc3886-espionage-operations"},{"source_name":"Mandiant Fortinet Zero Day","description":"Marvi, A. et al.. (2023, March 16). Fortinet Zero-Day and Custom Malware Used by Suspected Chinese Actor in Espionage Operation. Retrieved March 22, 2023.","url":"https://www.mandiant.com/resources/blog/fortinet-malware-ecosystem"}]},{"id":"S1228","name":"PUBLOAD","url":"https://attack.mitre.org/software/S1228","kind":"malware","description":"[PUBLOAD](https://attack.mitre.org/software/S1228) has utilized a magic value in C2 communications and only executes in memory when response packets match specific values of 17 03 03.(Citation: CSIRT CTI MUSTANG PANDA PUBLOAD TONESHELL JAN 2024)(Citation: IBM MUSTANG PANDA PUBLOAD CLAIMLOADER JUNE 2025)(Citation: 2025_IBM_PUBLOAD_TONESHELL_HIUPAN_CLAIMLOADER_MUSTANG PANDA)(Citation: 2022 November_TrendMicro_Earth Preta_Toneshell_Pubload)(Citation: PaloAlto MUSTANG PANDA PUBLOAD MARCH 2024)  [PUBLOAD](https://attack.mitre.org/software/S1228) has also used magic bytes consisting of 46 77 4d.(Citation: CSIRT CTI MUSTANG PANDA PUBLOAD TONESHELL JAN 2024)","relationship_id":"relationship--cc0c7d4b-eebb-4e95-9e03-972b1e943208","references":[{"source_name":"CSIRT CTI MUSTANG PANDA PUBLOAD TONESHELL JAN 2024","description":"CSIRT CTI. (2024, January 23). Stately Taurus Targets Myanmar Amidst Concerns over Military Junta’s Handling of Rebel Attacks. Retrieved August 4, 2025.","url":"https://csirt-cti.net/2024/01/23/stately-taurus-targets-myanmar/"},{"source_name":"IBM MUSTANG PANDA PUBLOAD CLAIMLOADER JUNE 2025","description":"Golo Muhr, Joshua Chung. (2025, June 23). Hive0154 aka Mustang Panda shifts focus on Tibetan community to deploy Pubload backdoor. Retrieved August 4, 2025.","url":"https://www.ibm.com/think/x-force/hive0154-mustang-panda-shifts-focus-tibetan-community-deploy-pubload-backdoor"},{"source_name":"2025_IBM_PUBLOAD_TONESHELL_HIUPAN_CLAIMLOADER_MUSTANG PANDA","description":"Golo Muhr, Joshua Chung. (2025, May 15). Hive0154 targeting US, Philippines, Pakistan and Taiwan in suspected espionage campaign. Retrieved August 4, 2025.","url":"https://www.ibm.com/think/x-force/hive0154-targeting-us-philippines-pakistan-taiwan"},{"source_name":"2022 November_TrendMicro_Earth Preta_Toneshell_Pubload","description":"Nick Dai, Vickie Su, Sunny Lu. (2022, November 18). Earth Preta Spear-Phishing Governments Worldwide. Retrieved August 4, 2025.","url":"https://www.trendmicro.com/en_us/research/22/k/earth-preta-spear-phishing-governments-worldwide.html"},{"source_name":"PaloAlto MUSTANG PANDA PUBLOAD MARCH 2024","description":"Unit42. (2024, March 26). ASEAN Entities in the Spotlight: Chinese APT Group Targeting. Retrieved August 4, 2025.","url":"https://unit42.paloaltonetworks.com/chinese-apts-target-asean-entities/"}]},{"id":"S1239","name":"TONESHELL","url":"https://attack.mitre.org/software/S1239","kind":"malware","description":"[TONESHELL](https://attack.mitre.org/software/S1239) has utilized a magic value in C2 communications and only executes in memory when response packets match specific values.(Citation: Trend Micro Mustang Panda Earth Preta Toneshell February 2025)(Citation: 2022 November_TrendMicro_Earth Preta_Toneshell_Pubload)(Citation: Trend Micro Mustang Panda Earth Preta TONESHELL June 2023)","relationship_id":"relationship--de50e857-f9c7-4d62-a228-91f1aa226e21","references":[{"source_name":"Trend Micro Mustang Panda Earth Preta Toneshell February 2025","description":"Nathaniel Morales, Nick Dai. (2025, February 18). Earth Preta Mixes Legitimate and Malicious Components to Sidestep Detection. Retrieved September 10, 2025.","url":"https://www.trendmicro.com/en_us/research/25/b/earth-preta-mixes-legitimate-and-malicious-components-to-sidestep-detection.html"},{"source_name":"2022 November_TrendMicro_Earth Preta_Toneshell_Pubload","description":"Nick Dai, Vickie Su, Sunny Lu. (2022, November 18). Earth Preta Spear-Phishing Governments Worldwide. Retrieved August 4, 2025.","url":"https://www.trendmicro.com/en_us/research/22/k/earth-preta-spear-phishing-governments-worldwide.html"},{"source_name":"Trend Micro Mustang Panda Earth Preta TONESHELL June 2023","description":"Sunny Lu, Vickie Su, Nick Dai. (2023, June 14). Behind the Scenes: Unveiling the Hidden Workings of Earth Preta. Retrieved September 10, 2025.","url":"https://www.trendmicro.com/en_us/research/23/f/behind-the-scenes-unveiling-the-hidden-workings-of-earth-preta.html"}]},{"id":"S9011","name":"BRUSHFIRE","url":"https://attack.mitre.org/software/S9011","kind":"malware","description":"[BRUSHFIRE](https://attack.mitre.org/software/S9011) has monitored inbound VPN traffic to compromised appliances until specific inbound packets contain a specific magic string/pattern instead of external beaconing.(Citation: Picus Security UNC5221 Ivanti May 2025)","relationship_id":"relationship--bf16e2d4-6d9a-4487-882a-776012a21831","references":[{"source_name":"Picus Security UNC5221 Ivanti May 2025","description":"Sila Ozeren Hacioglu. (2025, May 5). UNC5221’s Latest Exploit: Weaponizing CVE-2025-22457 in Ivanti Connect Secure. Retrieved April 13, 2026.","url":"https://www.picussecurity.com/resource/blog/unc5221-cve-2025-22457-ivanti-connect-secure"}]},{"id":"S9043","name":"Mini Shai-Hulud","url":"https://attack.mitre.org/software/S9043","kind":"malware","description":"[Mini Shai-Hulud](https://attack.mitre.org/software/S9043) has examined commit messages for a keyword followed by base64 encoded segments to validate communications and to execute subsequent actions to include exfiltration.(Citation: Hunt.io TeamPCP Toolkit MAY 2026)","relationship_id":"relationship--7ad7a5f3-8c10-4677-b0ce-f41fbb6f0306","references":[{"source_name":"Hunt.io TeamPCP Toolkit MAY 2026","description":"Hunt.io. (2026, May 14). How TeamPCP's Python Toolkit Survives a C2 Takedown: FIRESCALE, GitHub, and the Victim's Own Account. Retrieved July 16, 2026.","url":"https://hunt.io/blog/teampcp-python-toolkit-firescale-github-c2-takedown"}]}],"actors":[{"id":"G0094","name":"Kimsuky","url":"https://attack.mitre.org/groups/G0094","kind":"intrusion-set","description":"[Kimsuky](https://attack.mitre.org/groups/G0094) has used [TRANSLATEXT](https://attack.mitre.org/software/S1201) to redirect clients to legitimate Gmail, Naver or Kakao pages if the clients connect with no parameters.(Citation: Zscaler Kimsuky TRANSLATEXT) ","relationship_id":"relationship--ede02fd1-e1c4-434e-a1be-732b3255eacd","references":[{"source_name":"Zscaler Kimsuky TRANSLATEXT","description":"Park, S. (2024, June 27). Kimsuky deploys TRANSLATEXT to target South Korean academia. Retrieved October 14, 2024.","url":"https://www.zscaler.com/blogs/security-research/kimsuky-deploys-translatext-target-south-korean-academia#technical-analysis"}]},{"id":"G0129","name":"Mustang Panda","url":"https://attack.mitre.org/groups/G0129","kind":"intrusion-set","description":"[Mustang Panda](https://attack.mitre.org/groups/G0129) has utilized a magic value in C2 communications and only executes in memory when response packets match specific values of “17 03 03” or “46 77 4d”.(Citation: CSIRT CTI MUSTANG PANDA PUBLOAD TONESHELL JAN 2024)","relationship_id":"relationship--eb3ab439-c88b-4ef5-befd-8a356b6570c5","references":[{"source_name":"CSIRT CTI MUSTANG PANDA PUBLOAD TONESHELL JAN 2024","description":"CSIRT CTI. (2024, January 23). Stately Taurus Targets Myanmar Amidst Concerns over Military Junta’s Handling of Rebel Attacks. Retrieved August 4, 2025.","url":"https://csirt-cti.net/2024/01/23/stately-taurus-targets-myanmar/"}]},{"id":"G1048","name":"UNC3886","url":"https://attack.mitre.org/groups/G1048","kind":"intrusion-set","description":"[UNC3886](https://attack.mitre.org/groups/G1048) has used the TABLEFLIP traffic redirection utility to listen for specialized command packets on compromised FortiManager devices.(Citation: Mandiant Fortinet Zero Day)","relationship_id":"relationship--d74d9573-af4b-4984-ba5c-2cbd2b010fb2","references":[{"source_name":"Mandiant Fortinet Zero Day","description":"Marvi, A. et al.. (2023, March 16). Fortinet Zero-Day and Custom Malware Used by Suspected Chinese Actor in Espionage Operation. Retrieved March 22, 2023.","url":"https://www.mandiant.com/resources/blog/fortinet-malware-ecosystem"}]}],"mitigations":[{"id":"M1037","name":"Filter Network Traffic","url":"https://attack.mitre.org/mitigations/M1037","kind":"course-of-action","description":"Mitigation of some variants of this technique could be achieved through the use of stateful firewalls, depending upon how it is implemented.","relationship_id":"relationship--4b5e8e16-ddf4-4339-859b-f70f980d612b","references":[]},{"id":"M1042","name":"Disable or Remove Feature or Program","url":"https://attack.mitre.org/mitigations/M1042","kind":"course-of-action","description":"Disable Wake-on-LAN if it is not needed within an environment.","relationship_id":"relationship--c2a79396-f264-4439-94f1-113e3bf3a6be","references":[]}],"candidates":[],"simulation":{"atomic_status":"no_atomic_candidate","lab_execution":"not_run","browser_attack_runner":false,"prerequisites":"Use disposable lab hosts and test accounts, explicit target allowlists, a clean snapshot, bounded egress and a restore plan. Review every candidate and dependency before any execution.","scenario":null},"validation":{"source_identity":"checked_against_pinned_source","relationship_join":"exact_ids_no_inheritance","page_contract":"automated_checks_required","sensor_capture":"not_run","detection_backend":"not_run","adversary_simulation":"not_run","independent_incident_fact_check":"not_performed"},"technique_links":{"T1205.001":"/ttp-simulation/techniques/enterprise/T1205.001/","T1556.004":"/ttp-simulation/techniques/enterprise/T1556.004/","T1601.001":"/ttp-simulation/techniques/enterprise/T1601.001/","T1205":"/ttp-simulation/techniques/enterprise/T1205/"},"synthetic":{"schema":"1200km.ttp.collection-fixture.v1","synthetic":true,"technique_key":"enterprise/T1205","purpose":"Collection/parser contract exercise, NOT a positive example or detection of this TTP.","events":[{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0064","collector":"illustrative-lab-collector","observation":{"interpreter":"/bin/sh","command_line":"printf LAB_TELEMETRY_CHECK","actor_uid":1000,"session_id":"lab-session-1"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0082","collector":"illustrative-lab-collector","observation":{"process_guid":"lab-process-001","destination_ip":"198.51.100.20","destination_port":443,"protocol":"tcp","initiated":true}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0085","collector":"illustrative-lab-collector","observation":{"flow_id":"lab-flow-1","protocol":"http","method":"GET","path":"/lab-check","payload_excerpt":"LAB_TELEMETRY_CHECK"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0078","collector":"illustrative-lab-collector","observation":{"source_ip":"192.0.2.10","destination_ip":"198.51.100.20","destination_port":443,"protocol":"tcp","bytes_sent":128,"bytes_received":512}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0032","collector":"illustrative-lab-collector","observation":{"process_guid":"lab-process-001","image":"C:\\Windows\\System32\\whoami.exe","parent_image":"C:\\Windows\\System32\\cmd.exe","command_line":"whoami","user":"LAB\\analyst"}}]}}