T1205.001 — Port Knocking

Tactics: Stealth, Persistence, Command and Control · Platforms: Linux, macOS, Network Devices, Windows

Adversaries may use port knocking to hide open ports used for persistence or command and control. To enable a port, an adversary sends a series of attempted connections to a predefined sequence of closed ports. After the sequence is completed, opening a port is often accomplished by the host based…

Sub-technique of Traffic Signaling (T1205).

Sigma detection rules (4)

title: "T1205.001 Traffic Signaling: Port Knocking"
id: 9842b753-d135-4f18-b2d6-09556bc59ad4
description: 'Port-knock → rule/daemon change → first successful connect (T1205.001). (Retargeted to Sysmon EventID matching process_creation telemetry for reliable field coverage.) Tune using: TimeWindow, MinSequenceLen, RuleChangeAllowList, WatchedPorts.'
references:
  - https://attack.mitre.org/techniques/T1205/001
author: Shahrukh Khan
date: 2026-02-12
license: MIT
tags:
  - attack.stealth
  - attack.persistence
  - attack.command-and-control
  - attack.t1205.001

logsource:
  category: process_creation
  product: windows
  service: sysmon

detection:
  selection_netsh:
    Image|endswith: '\netsh.exe'

  selection_portproxy_add:
    CommandLine|contains|all:
      - 'interface'
      - 'portproxy'
      - 'add'
      - 'v4tov4'

  selection_full_syntax:
    CommandLine|contains|all:
      - 'listenport='
      - 'connectport='
      - 'connectaddress='

  condition: selection_netsh and selection_portproxy_add and selection_full_syntax

falsepositives:
  - Legitimate port-forwarding configured by network administrators using the full v4tov4 listenport/connectport/connectaddress syntax.

level: high

title: "T1205.001 Traffic Signaling: Port Knocking"
id: ebefa363-130b-4818-af2d-e67ee2d9180c
description: 'knockd itself never issues an outbound connect() syscall — it passively sniffs the knock sequence via libpcap or a raw socket, so requiring syscall=connect attributed to the knockd process can never fire on genuine port-knocking activity. The closest Linux-observable proxy is the firewall rule-insertion command that knockd executes once a valid knock sequence completes (commonly an iptables or nft ACCEPT rule insertion for the previously closed port). Full validation of the knock sequence itself requires network packet capture, which auditd process telemetry cannot provide. Tune using: ServicePort, KnockTolerance, MgmtAllowList.'
references:
  - https://attack.mitre.org/techniques/T1205/001
author: Shahrukh Khan
date: 2026-05-10
license: MIT
tags:
  - attack.stealth
  - attack.persistence
  - attack.command-and-control
  - attack.t1205.001

logsource:
  category: process_creation
  product: linux
  service: auditd

detection:
  selection:
    type: EXECVE
    a0|endswith:
      - '/iptables'
      - '/ip6tables'
      - '/nft'
  selection_insert:
    a1|contains:
      - '-I'
      - '-A'

  condition: selection and selection_insert

falsepositives:
  - Routine firewall administration or configuration-management tooling (ansible/puppet/salt) inserting rules; confirming an actual port-knock trigger requires correlating with the raw multi-packet knock sequence via network capture (pcap), which is not available in auditd process telemetry.

level: medium

title: "T1205.001 Traffic Signaling: Port Knocking"
id: e95aae12-b5df-48ef-a101-631e4d1c40fd
description: 'Port-knock → rule/daemon change → first successful connect (T1205.001). (Retargeted to the process_creation macOS unified-log telemetry that actually captures this techniques behavior; see logsource below.) Tune using: PFAnchorPaths, DevMode.'
references:
  - https://attack.mitre.org/techniques/T1205/001
author: Shahrukh Khan
date: 2026-03-27
license: MIT
tags:
  - attack.stealth
  - attack.persistence
  - attack.command-and-control
  - attack.t1205.001

logsource:
  category: process_creation
  product: macos

detection:
  selection:
    Image|endswith: '/pfctl'
    CommandLine|contains|all:
      - '-f'
      - 'anchor'
  condition: selection

falsepositives:
  - Legitimate firewall configuration changes by administrators loading a new pf anchor file; distinguishing a traffic-signaling backdoor from routine pf configuration requires observing the actual triggering packet pattern, which process_creation telemetry cannot express.

level: medium

title: "T1205.001 Traffic Signaling: Port Knocking"
id: fb15b093-5ce2-4285-845d-656c154177e1
description: 'Port-knock -> rule/daemon change -> first successful connect (T1205.001). (Data Component: Network Traffic Flow; baseline tier: fallback.) This base rule flags individual connect() invocations by nc/ncat/hping3/knock; pair it with the companion correlation rule appended below, which requires connects to multiple distinct destination ports from the same process within a short window to approximate an actual port-knock sequence. Tune using: MgmtPortSet, DeviceRole.'
references:
  - https://attack.mitre.org/techniques/T1205/001
author: Shahrukh Khan
date: 2026-01-02
license: MIT
tags:
  - attack.stealth
  - attack.persistence
  - attack.command-and-control
  - attack.t1205.001

logsource:
  category: network_connection
  product: linux
  service: auditd

detection:
  selection:
    type: SYSCALL
    syscall: connect
    exe|endswith:
      - '/nc'
      - '/ncat'
      - '/hping3'
      - '/knock'

  condition: selection

falsepositives:
  - 'Legitimate use of netcat or hping3 for network troubleshooting; a single connect() event alone is a weak proxy for port knocking -- rely on the companion correlation rule''s distinct-destination-port threshold within the time window to raise confidence, and tune MgmtPortSet/DeviceRole to expected management traffic.'

level: medium
---
title: "T1205.001 Traffic Signaling: Port Knocking - Distinct Port Connect Sequence"
id: 1b6e9a3c-4f21-4e8d-9c77-2a5f6d0b8e41
description: 'Correlation companion for fb15b093-5ce2-4285-845d-656c154177e1: counts connect() invocations by nc/ncat/hping3/knock to distinct destination ports from the same process within a 2-minute window, approximating a port-knock sequence that a single auditd SYSCALL record cannot express on its own.'
status: experimental
correlation:
  type: value_count
  rules:
    - fb15b093-5ce2-4285-845d-656c154177e1
  group-by:
    - exe
  timespan: 2m
  condition:
    field: dst_port
    gte: 4
level: high

Related sub-techniques

• T1205.002 Socket Filters

Explore

• All Sigma rules for MITRE ATT&CK
• Sigma rule format guide
• Full T1205.001 intelligence — ATT&CK Intelligence View
• Official MITRE ATT&CK entry
• Built by Shahrukh Khan