T1571 Non-Standard Port — Attack Simulation

DC0038 collection page — Select the application event family required by the detection and document its native schema before normalization.

Providers and collection configuration

• Application audit logs: First-party service events and request/result fields; schema is application-specific.
• OpenTelemetry-compatible log pipelines: Transport and normalization of emitted records; do not create missing audit instrumentation.

• Enable the application audit category or instrument the owned lab application at the authorization/action boundary.
• Define a schema with timestamp, service, actor, object, action, result and correlation ID. Export structured records through an authenticated collector.
• Redact secrets and personal content, separate audit from debug logs, set retention and verify delivery during rotation/restart.

Required normalized fields: service, action, actor, record_count, result.

Illustrative collection event

Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.

{
  "schema": "1200km.telemetry.example.v1",
  "synthetic": true,
  "timestamp": "2026-09-27T12:00:00Z",
  "telemetry_id": "DC0038",
  "collector": "illustrative-lab-collector",
  "observation": {
    "service": "lab-portal",
    "action": "export_requested",
    "actor": "lab-reader",
    "record_count": 3,
    "result": "authorized"
  }
}

Visibility limits: Debug output is not necessarily a durable audit trail. Application developers must emit the relevant event; installing a log pipeline does not make an absent event exist.

DC0082 collection page — Enable scoped Sysmon NetworkConnect (3), disabled by default, or a platform-equivalent process-aware network sensor.

Providers and collection configuration

• Microsoft Sysmon: Windows event-based collection; enable the event types needed below.
• Linux Audit: Linux alternative for supported system-call and file events; different semantics and fields.
• Apple Endpoint Security clients: macOS alternative where the subscribed event exists; requires an entitled, approved client, not an iOS collector.

• On a disposable Windows host, review the installed Sysmon schema and current configuration; merge scoped event filters into the existing policy rather than replacing it.
• Forward Microsoft-Windows-Sysmon/Operational to the lab collector. Preserve event ID, timestamp, computer, process identifiers and the original event.
• For Linux or macOS, select the equivalent sensor separately and test its emitted fields; a Windows event ID does not transfer across platforms.

Required normalized fields: process_guid, destination_ip, destination_port, protocol, initiated.

Illustrative collection event

Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.

{
  "schema": "1200km.telemetry.example.v1",
  "synthetic": true,
  "timestamp": "2026-09-27T12:00:00Z",
  "telemetry_id": "DC0082",
  "collector": "illustrative-lab-collector",
  "observation": {
    "process_guid": "lab-process-001",
    "destination_ip": "198.51.100.20",
    "destination_port": 443,
    "protocol": "tcp",
    "initiated": true
  }
}

Visibility limits: Event filtering and sensor versions change coverage. High-volume image-load and process-access collection needs tuning; endpoint events alone do not establish intent.

DC0085 collection page — Scope approved packet capture/protocol content collection to the lab flow; retain capture provenance and truncation indicators.

Providers and collection configuration

• Zeek: Connection and protocol metadata from traffic visible to the sensor.
• Suricata EVE: Configured flow, alert, DNS, HTTP, TLS and protocol records.

• Use an authorized lab TAP/SPAN, virtual mirror or gateway interface. Define which traffic crosses it; avoid assuming visibility into every segment.
• Enable the required Zeek analyzers or Suricata EVE event types. Export logs with sensor identity, clock synchronization and flow correlation identifiers.
• Monitor capture loss, truncation and exporter sampling. Capture payload only with approval and restrictive retention; encryption normally prevents plaintext inspection.

Required normalized fields: flow_id, protocol, method, path, payload_excerpt.

Illustrative collection event

Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.

{
  "schema": "1200km.telemetry.example.v1",
  "synthetic": true,
  "timestamp": "2026-09-27T12:00:00Z",
  "telemetry_id": "DC0085",
  "collector": "illustrative-lab-collector",
  "observation": {
    "flow_id": "lab-flow-1",
    "protocol": "http",
    "method": "GET",
    "path": "/lab-check",
    "payload_excerpt": "LAB_TELEMETRY_CHECK"
  }
}

Visibility limits: Flows are not packet payloads. NAT, asymmetric routes, encryption, missing mirrors and sampling can hide attribution or content. A destination connection alone does not prove malicious intent.

DC0078 collection page — Collect Zeek conn.log, Suricata flow events or exporter equivalents, including observation point and sampling settings.

Providers and collection configuration

• Zeek: Connection and protocol metadata from traffic visible to the sensor.
• Suricata EVE: Configured flow, alert, DNS, HTTP, TLS and protocol records.
• AWS VPC Flow Logs: IP traffic metadata alternative; no packet payload or DNS answer history, and some traffic is not logged.

• Use an authorized lab TAP/SPAN, virtual mirror or gateway interface. Define which traffic crosses it; avoid assuming visibility into every segment.
• Enable the required Zeek analyzers or Suricata EVE event types. Export logs with sensor identity, clock synchronization and flow correlation identifiers.
• Monitor capture loss, truncation and exporter sampling. Capture payload only with approval and restrictive retention; encryption normally prevents plaintext inspection.

Required normalized fields: source_ip, destination_ip, destination_port, protocol, bytes_sent, bytes_received.

Illustrative collection event

Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.

{
  "schema": "1200km.telemetry.example.v1",
  "synthetic": true,
  "timestamp": "2026-09-27T12:00:00Z",
  "telemetry_id": "DC0078",
  "collector": "illustrative-lab-collector",
  "observation": {
    "source_ip": "192.0.2.10",
    "destination_ip": "198.51.100.20",
    "destination_port": 443,
    "protocol": "tcp",
    "bytes_sent": 128,
    "bytes_received": 512
  }
}

Visibility limits: Flows are not packet payloads. NAT, asymmetric routes, encryption, missing mirrors and sampling can hide attribution or content. A destination connection alone does not prove malicious intent.

DC0032 collection page — Collect Sysmon ProcessCreate (1); preserve ProcessGuid and parent identifiers. Security 4688 is an alternative with separate audit/command-line settings.

Providers and collection configuration

• Microsoft Sysmon: Windows event-based collection; enable the event types needed below.
• Linux Audit: Linux alternative for supported system-call and file events; different semantics and fields.
• Apple Endpoint Security clients: macOS alternative where the subscribed event exists; requires an entitled, approved client, not an iOS collector.

• On a disposable Windows host, review the installed Sysmon schema and current configuration; merge scoped event filters into the existing policy rather than replacing it.
• Forward Microsoft-Windows-Sysmon/Operational to the lab collector. Preserve event ID, timestamp, computer, process identifiers and the original event.
• For Linux or macOS, select the equivalent sensor separately and test its emitted fields; a Windows event ID does not transfer across platforms.

Required normalized fields: process_guid, image, parent_image, command_line, user.

<EventFiltering>
  <ProcessCreate onmatch="include">
    <Image condition="is">C:\Windows\System32\whoami.exe</Image>
  </ProcessCreate>
</EventFiltering>

This fragment only selects the named process. It is not a complete production policy. Inspect the installed schema with sysmon64 -s; preserve existing rules, then apply the reviewed complete configuration with sysmon64 -c <configuration-file>.

Illustrative collection event

Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.

{
  "schema": "1200km.telemetry.example.v1",
  "synthetic": true,
  "timestamp": "2026-09-27T12:00:00Z",
  "telemetry_id": "DC0032",
  "collector": "illustrative-lab-collector",
  "observation": {
    "process_guid": "lab-process-001",
    "image": "C:\\Windows\\System32\\whoami.exe",
    "parent_image": "C:\\Windows\\System32\\cmd.exe",
    "command_line": "whoami",
    "user": "LAB\\analyst"
  }
}

Visibility limits: Event filtering and sensor versions change coverage. High-volume image-load and process-access collection needs tuning; endpoint events alone do not establish intent.

MITRE detection strategy

5 exact-tagged source rules. A source tag is a discovery aid, not a relevance verdict. Check the observation point and actual condition of each rule.

• Potentially Suspicious Malware Callback Communication - Linux — test; category: network_connection; product: linux.
• Suspicious DNS Z Flag Bit Set — test; product: zeek; service: dns.
• Potentially Suspicious Malware Callback Communication — test; category: network_connection; product: windows.
• Communication To Uncommon Destination Ports — test; category: network_connection; product: windows.
• Testing Usage of Uncommonly Used Port — test; product: windows; category: ps_script; definition: Requirements: Script Block Logging must be enabled.

• S0013 PlugX — malware.

  PlugX has used random, high-number, non-standard ports to listen for subsequent actions and C2 activities.[Sygnia VelvetAnt 2024A]

  Exact relationship: relationship--c5692c9d-8cac-4105-ae0b-f3b6c60a2253
• S0021 Derusbi — malware.

  Derusbi has used unencrypted HTTP on port 443 for C2.[Fidelis Turbo]

  Exact relationship: relationship--a5bb3ddf-446a-42c4-b522-112ad643c678
• S0148 RTM — malware.

  RTM used Port 44443 for its VNC module.[ESET RTM Feb 2017]

  Exact relationship: relationship--b2848d62-76a1-465c-b12e-7dc3113e6bbe
• S0149 MoonWind — malware.

  MoonWind communicates over ports 80, 443, 53, and 8080 via raw sockets instead of the protocols usually associated with the ports.[Palo Alto MoonWind March 2017]

  Exact relationship: relationship--3ffac9f5-9a5e-41dd-aa7d-c981842015d7
• S0153 RedLeaves — malware.

  RedLeaves can use HTTP over non-standard ports, such as 995, for C2.[PWC Cloud Hopper Technical Annex April 2017]

  Exact relationship: relationship--ec55cdc1-8ca2-42c9-a1d9-9755d24bc294
• S0237 GravityRAT — malware.

  GravityRAT has used HTTP over a non-standard port, such as TCP port 46769.[Talos GravityRAT]

  Exact relationship: relationship--e61e5dc3-b6ac-4909-b188-eaede02385df
• S0239 Bankshot — malware.

  Bankshot binds and listens on port 1058 for HTTP traffic while also utilizing a FakeTLS method.[US-CERT Bankshot Dec 2017]

  Exact relationship: relationship--e9b71895-a9d2-4023-930b-4204f6c2d325
• S0245 BADCALL — malware.

  BADCALL communicates on ports 443 and 8000 with a FakeTLS method.[US-CERT BADCALL]

  Exact relationship: relationship--c13bc6b0-a8fa-4c52-9774-3738a5f1ce90
• S0246 HARDRAIN — malware.

  HARDRAIN binds and listens on port 443 with a FakeTLS method.[US-CERT HARDRAIN March 2018]

  Exact relationship: relationship--53e123a8-0794-4bec-b71b-3c4b4a94057f
• S0262 QuasarRAT — tool.

  QuasarRAT can use port 4782 on the compromised host for TCP callbacks.[CISA AR18-352A Quasar RAT December 2018]

  Exact relationship: relationship--bfbabaff-1918-4a35-b5ab-8aa981e50027
• S0263 TYPEFRAME — malware.

  TYPEFRAME has used ports 443, 8080, and 8443 with a FakeTLS method.[US-CERT TYPEFRAME June 2018]

  Exact relationship: relationship--d21527b8-a8c8-4c95-9061-21c49155232e
• S0266 TrickBot — malware.

  Some TrickBot samples have used HTTP over ports 447 and 8082 for C2.[S2 Grupo TrickBot June 2017][Fidelis TrickBot Oct 2016][Trend Micro Totbrick Oct 2016] Newer versions of TrickBot have been known to use a custom communication protocol which sends the data unencrypted over port 443. [Bitdefender Trickbot VNC module Whitepaper 2021]

  Exact relationship: relationship--b75e158b-3c2e-425d-a14e-84a974d86c8c
• S0352 OSX_OCEANLOTUS.D — malware.

  OSX_OCEANLOTUS.D has used a custom binary protocol over TCP port 443 for C2.[Unit42 OceanLotus 2017]

  Exact relationship: relationship--5a34e6af-f5e1-4191-aec0-06a92201f414
• S0367 Emotet — malware.

  Emotet has used HTTP over ports such as 20, 22, 443, 7080, and 50000, in addition to using ports commonly associated with HTTP/S.[Talos Emotet Jan 2019][Binary Defense Emotes Wi-Fi Spreader]

  Exact relationship: relationship--12c14ace-db29-4b08-a052-ba867c9ba534
• S0376 HOPLIGHT — malware.

  HOPLIGHT has connected outbound over TCP port 443 with a FakeTLS method.[US-CERT HOPLIGHT Apr 2019]

  Exact relationship: relationship--36983a10-4fdb-4bfc-83a0-78f4d11e83df
• S0385 njRAT — malware.

  njRAT has used port 1177 for HTTP C2 communications.[Trend Micro njRAT 2018]

  Exact relationship: relationship--8131a5ed-f95f-406d-ae56-e5e10c8ced74
• S0412 ZxShell — malware.

  ZxShell can use ports 1985 and 1986 in HTTP/S communication.[Talos ZxShell Oct 2014]

  Exact relationship: relationship--3a5c4e73-3657-470e-882b-563f3ca599e7
• S0428 PoetRAT — malware.

  PoetRAT used TLS to encrypt communications over port 143[Talos PoetRAT April 2020]

  Exact relationship: relationship--207f1084-a466-4e08-a157-886db373f09a
• S0455 Metamorfo — malware.

  Metamorfo has communicated with hosts over raw TCP on port 9999.[FireEye Metamorfo Apr 2018]

  Exact relationship: relationship--6cc8e1ce-c007-4a26-bd3b-cac73bb98c73
• S0491 StrongPity — malware.

  StrongPity has used HTTPS over port 1402 in C2 communication.[Bitdefender StrongPity June 2020]

  Exact relationship: relationship--18714758-e6ea-4f61-87c9-6340c0001b9c
• S0493 GoldenSpy — malware.

  GoldenSpy has used HTTP over ports 9005 and 9006 for network traffic, 9002 for C2 requests, 33666 as a WebSocket, and 8090 to download files.[Trustwave GoldenSpy June 2020]

  Exact relationship: relationship--2243acac-6401-41df-b658-2a36f7977d15
• S0515 WellMail — malware.

  WellMail has been observed using TCP port 25, without using SMTP, to leverage an open port for secure command and control communications.[CISA WellMail July 2020][NCSC APT29 July 2020]

  Exact relationship: relationship--31b54e57-8a8c-4c0f-9170-b3694dd82005
• S0574 BendyBear — malware.

  BendyBear has used a custom RC4 and XOR encrypted protocol over port 443 for C2.[Unit42 BendyBear Feb 2021]

  Exact relationship: relationship--730a735c-1008-490e-b0c8-6938b858b28a
• S0687 Cyclops Blink — malware.

  Cyclops Blink can use non-standard ports for C2 not typically associated with HTTP or HTTPS traffic.[NCSC Cyclops Blink February 2022]

  Exact relationship: relationship--f4a65903-0b28-4e52-ad3b-bb7c55772509
• S1016 MacMa — malware.

  MacMa has used TCP port 5633 for C2 Communication.[ESET DazzleSpy Jan 2022]

  Exact relationship: relationship--a06533f5-02f9-4246-9315-0fa8df3465e0
• S1031 PingPull — malware.

  PingPull can use HTTPS over port 8080 for C2.[Unit 42 PingPull Jun 2022]

  Exact relationship: relationship--0b2b567c-718c-485f-b187-2bf6c6bb0c76
• S1049 SUGARUSH — malware.

  SUGARUSH has used port 4585 for a TCP connection to its C2.[Mandiant UNC3890 Aug 2022]

  Exact relationship: relationship--2311b504-e0c3-4594-8174-f9ce86941bc3
• S1078 RotaJakiro — malware.

  RotaJakiro uses a custom binary protocol over TCP port 443.[netlab360 rotajakiro vs oceanlotus]

  Exact relationship: relationship--af74a9b1-6c74-45b6-a21d-38686afb202c
• S1085 Sardonic — malware.

  Sardonic has the ability to connect with actor-controlled C2 servers using a custom binary protocol over port 443.[Bitdefender Sardonic Aug 2021]

  Exact relationship: relationship--9ee6eb40-881c-4928-a036-58a8df0e8f95
• S1130 Raspberry Robin — malware.

  Raspberry Robin will communicate via HTTP over port 8080 for command and control traffic.[RedCanary RaspberryRobin 2022]

  Exact relationship: relationship--30cfec26-a5ff-460d-876c-ca7f9d1e639f
• S1145 Pikabot — malware.

  Pikabot uses non-standard ports, such as 2967, 2223, and others, for HTTPS command and control communication.[Elastic Pikabot 2024]

  Exact relationship: relationship--569abeb3-4d27-4157-a50f-0ec8fc4b3f92
• S1155 Covenant — tool.

  Covenant listeners and controllers can be configured to use non-standard ports.[Github Covenant]

  Exact relationship: relationship--22fac24b-a5a4-45ef-b6c4-0247a877b23a
• S1211 Hannotog — malware.

  Hannotog uses non-standard listening ports, such as UDP 5900, for command and control purposes.[Symantec Bilbug 2022]

  Exact relationship: relationship--015aa3fc-58b6-4ee0-afa2-7bb60d5b108f
• S1217 VIRTUALPITA — malware.

  VIRTUALPITA has created listeners on hard coded TCP ports such as 2233, 7475, and 18098.[Google Cloud Threat Intelligence ESXi VIBs 2022]

  Exact relationship: relationship--d2fc5856-5010-41e7-9175-958e3029df47
• S1218 VIRTUALPIE — malware.

  VIRTUALPIE has created listeners on hard coded TCP port 546.[Google Cloud Threat Intelligence ESXi VIBs 2022]

  Exact relationship: relationship--acb3d56b-d5bc-4be9-be1e-f1bda4c7771e
• S1245 InvisibleFerret — malware.

  InvisibleFerret has been observed utilizing HTTP communications to the C2 server over ports 1224, 2245 and 8637.[Esentire ContagiousInterview BeaverTail InvisibleFerret November 2024]

  Exact relationship: relationship--c57b65a3-294a-43fd-af9c-b764e9305190
• S1246 BeaverTail — malware.

  BeaverTail has communicated with C2 IP addresses over ports 1224 or 1244.[ESET Contagious Interview BeaverTail InvisibleFerret February 2025][PaloAlto ContagiousInterview BeaverTail InvisibleFerret November 2023][PaloAlto Unit42 ContagiousInterview BeaverTail InvisibileFerret October 2024]

  Exact relationship: relationship--7a61c895-add6-4631-aa2e-53efe5a85f44
• S9001 SystemBC — malware.

  The server component of SystemBC has used various TCP ports for C2 communication.[TrumanKroll_SYSTEMBCServer_Jan2024]

  Exact relationship: relationship--62bfecb7-7388-410a-afb3-fcd60fbc0af9
• S9010 GlassWorm — malware.

  GlassWorm has distributed C2 using BitTorrent’s Distributed Hash Table (DHT) network to harness a decentralized command capability.[Koi Glassworm InvisibleCode October 2025]

  Exact relationship: relationship--14787d55-5815-43ee-ae4b-a31334ceed97
• S9023 HiddenFace — malware.

  HiddenFace's passive mode listens on TCP 47000.[Trend Micro Earth Kasha NOV 2024][JPCERT MirrorFace JUL 2024]

  Exact relationship: relationship--2d50f9cb-8164-4cbe-bff9-d7ecfa55f123
• S9024 SPAWNCHIMERA — malware.

  SPAWNCHIMERA has the ability to bind on a localhost and listen on port 8300.[Google UNC5221 BRICKSTORM SPAWNCHIMERA April 2024][JPCERT SPAWNCHIMERA Ivanti February 2025]

  Exact relationship: relationship--c0a3674d-ff9b-49e0-8a18-43ba8d795163

Testing uncommonly used port utilizing PowerShell. APT33 has been known to attempt telnet over port 8081. Upon execution, details about the successful
port check will be displayed.

Pinned Atomic procedure · 21fe622f-8e53-4b31-ba83-6d333c2583f4 · windows · powershell.

Elevation: not declared required. Cleanup: not declared. This is source documentation, not an execution approval.

Source-defined inputs

• port: Specify uncommon port number (type string; source default 8081)
• domain: Specify target hostname (type string; source default google.com)

Review the upstream command, dependencies and cleanup at the source link. Source defaults may refer to real infrastructure or destructive actions; they are not authorized targets. No automatic install, prerequisite download or command execution is provided.

Testing uncommonly used port utilizing telnet.

Pinned Atomic procedure · 5db21e1d-dd9c-4a50-b885-b1e748912767 · linux, macos · sh.

Elevation: not declared required. Cleanup: not declared. This is source documentation, not an execution approval.

Source-defined inputs

• port: Specify uncommon port number (type string; source default 8081)
• domain: Specify target hostname (type string; source default google.com)

Review the upstream command, dependencies and cleanup at the source link. Source defaults may refer to real infrastructure or destructive actions; they are not authorized targets. No automatic install, prerequisite download or command execution is provided.

1 prerequisite definitions:

• Requires telnet

• M1030 Network Segmentation

  Properly configure firewalls and proxies to limit outgoing traffic to only necessary ports for that particular network segment.

• M1031 Network Intrusion Prevention

  Network intrusion detection and prevention systems that use network signatures to identify traffic for specific adversary malware can be used to mitigate activity at the network level.