T1571 — Non-Standard Port

Tactic: Command and Control · Platforms: ESXi, Linux, macOS, Windows

Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088 or port 587 as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing…

Sigma detection rules (4)

T1571 Non-Standard Port

title: T1571 Non-Standard Port
id: d5c1a7e7-7af2-4a2e-9584-f92a65942f6a
description: 'Detection Strategy for Non-Standard Ports. (Retargeted from the original process_creation label to network_connection — this is the telemetry source that actually captures this technique''s behavior; see logsource below.) Tune using: PortThresholds, ProcessAllowList, TimeWindow.'
references:
  - https://attack.mitre.org/techniques/T1571
author: Shahrukh Khan
date: 2026-01-28
license: MIT
tags:
  - attack.command-and-control
  - attack.t1571

logsource:
  category: network_connection
  product: windows
  service: sysmon

detection:
  selection:
    DestinationPort:
      - 8080
      - 8443
      - 4444
      - 1234
    Image|endswith:
      - '\powershell.exe'
      - '\rundll32.exe'

  condition: selection

falsepositives:
  - Legitimate internal proxy or dev-server traffic frequently uses these exact ports; scope to unexpected destination IPs or process ancestry for a meaningful signal.

level: medium

T1571 Non-Standard Port

title: T1571 Non-Standard Port
id: b937d290-8cdc-44fa-9ff4-8d7d60ef104d
description: 'Detection Strategy for Non-Standard Ports. The prior version never inspected a destination port at all - it just flagged any use of nc/ncat/socat - so it could not actually detect a non-standard protocol/port pairing and was really a generic suspicious-tool-execution rule mislabeled as T1571. Retargeted to curl/wget invocations whose own URL argument specifies an explicit, non-default port for the http/https scheme (e.g. http://host:8088 or https://host:587), which is a genuine argv-observable protocol-port mismatch rather than requiring an external network-flow join. Tune using: AllowedNonStandardPorts.'
references:
  - https://attack.mitre.org/techniques/T1571
author: Shahrukh Khan
date: 2026-01-15
license: MIT
tags:
  - attack.command-and-control
  - attack.t1571

logsource:
  category: process_creation
  product: linux

detection:
  selection:
    type: EXECVE
    a0|endswith:
      - '/curl'
      - '/wget'
  selection_nonstandard_http_port:
    a1|re: '^https?://[^/]+:(?!80/|443/|80$|443$)[0-9]+'

  condition: selection and selection_nonstandard_http_port

falsepositives:
  - Legitimate internal services and dev/test environments routinely run HTTP(S) on non-default ports (8080, 8443, 3000, etc.); scope AllowedNonStandardPorts to the organization's own known internal service ports.

level: medium

T1571 Non-Standard Port

title: T1571 Non-Standard Port
id: 8d4b449d-09cc-47ba-a191-0d4eec340c8e
description: 'Detection Strategy for Non-Standard Ports. (Retargeted to the network_connection macOS unified-log telemetry that actually captures this techniques behavior; see logsource below.) Tune using: BaselinePortProfiles.'
references:
  - https://attack.mitre.org/techniques/T1571
author: Shahrukh Khan
date: 2026-04-28
license: MIT
tags:
  - attack.command-and-control
  - attack.t1571

logsource:
  category: network_connection
  product: macos

detection:
  selection:
    Image|endswith:
      - '/curl'
      - '/nc'
    DestinationPort:
      - 4444
      - 8443
      - 53
  filter:
    Image|endswith: '/curl'
    DestinationPort: 53

  condition: selection and not filter

falsepositives:
  - Internal tooling and some legitimate services intentionally run HTTP or custom protocols on non-standard high ports, so without a real per-host baseline this list of ports is only indicative, not conclusive.

level: medium

T1571 Non-Standard Port

title: T1571 Non-Standard Port
id: d64c916f-70a0-44fc-924c-809e615fd7c1
description: 'Detection Strategy for Non-Standard Ports. (Retargeted to the process_creation ESXi telemetry that actually captures this techniques behavior; see logsource below.) Tune using: ESXiAllowedPorts.'
references:
  - https://attack.mitre.org/techniques/T1571
author: Shahrukh Khan
date: 2026-02-28
license: MIT
tags:
  - attack.command-and-control
  - attack.t1571

logsource:
  product: esxi
  service: shell

detection:
  selection:
    CommandLine|contains: 'esxcli network firewall ruleset'
  selection_port:
    CommandLine|contains:
      - 'allowedip'
      - '--allowed-all true'

  condition: selection and selection_port

falsepositives:
  - Legitimate firewall ruleset customization to permit a monitoring agent or backup product on a non-default port from ESXiAllowedPorts; hostd/shell log the ruleset name and allowed-IP text but do not expose raw port numbers on the wire for connections that bypass firewall rulesets entirely.

level: medium

Explore