T1571 Non-Standard Port — Detection Rules

Source-backed rule directory

• Potentially Suspicious Malware Callback Communication - Linux · test · high · {"category":"network_connection","product":"linux"}
• Suspicious DNS Z Flag Bit Set · test · medium · {"product":"zeek","service":"dns"}
• Potentially Suspicious Malware Callback Communication · test · high · {"category":"network_connection","product":"windows"}
• Communication To Uncommon Destination Ports · test · medium · {"category":"network_connection","product":"windows"}
• Testing Usage of Uncommonly Used Port · test · medium · {"product":"windows","category":"ps_script","definition":"Requirements: Script Block Logging must be enabled"}

Atlas deterministic concepts

No exact concept selected.

Anomaly models

No exact Atlas model in this snapshot.

ATT&CK analytic guidance

DET0227 Detection Strategy for Non-Standard Ports

AN0633 Analytic 0633

Processes initiating outbound connections on uncommon ports or using protocols inconsistent with the assigned port. Correlating process creation with subsequent network connections reveals anomalies such as svchost.exe or Office applications using high, atypical ports.

AN0634 Analytic 0634

Unusual daemons or user processes binding/listening on ports outside of standard ranges, or initiating client connections using mismatched protocol/port pairings.

AN0635 Analytic 0635

Applications making outbound connections on non-standard ports or launchd services bound to ports inconsistent with system baselines.

AN0636 Analytic 0636

VM services or management daemons communicating on ports not defined by VMware defaults, such as vpxa or hostd processes initiating traffic over high-numbered or unexpected ports.