T1571 · Non-Standard Port

Sunturai

Detections can measure how the public catalogue is used — which detections people look for, and which pages bring them here. It sets a cookie that recognises this browser for 180 days. It is never linked to an account and never follows you to other sites. Privacy notice

T1571 · Non-Standard Port · Sunturai

attack-patternenterprise-attackT1571

Non-Standard Port

attack-pattern--b18eae87-b469-4e14-b454-b171b416bc18

Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088(Citation: Symantec Elfin Mar 2019) or port 587(Citation: Fortinet Agent Tesla April 2018) as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data. Adversaries may also make changes to victim systems to abuse non-standard ports. For example, Registry keys and other configuration settings can be used to modify protocol and port pairings.(Citation: change_rdp_port_conti)

Created: Mar 14, 2020, 6:18 PM UTC
Modified: May 12, 2026, 3:12 PM UTC

42 published detections cover this technique

Every one carries the source it came from and the licence it was published under.

Detections covering this technique
Detection	Severity	Source	Published	Licence
Cisco Secure Firewall - File Download Over Uncommon Port	Informational	Splunk security content	Oct 6, 2026	Apache License 2.0
Cisco NVM - Outbound Connection to Suspicious Port	Informational	Splunk security content	Oct 6, 2026	Apache License 2.0
SMTP to the Internet on Port 26/TCP	Low	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
Unusual Linux Network Port Activity	Low	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
Suspicious Outbound Network Connection via Unsigned Binary	High	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
Script Interpreter Connection to Non-Standard Port	Medium	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
Potential Data Exfiltration Activity to an Unusual Destination Port	Low	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
Suricata and Elastic Defend Network Correlation	Medium	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
Palo Alto - potential beaconing detected	Low	—	Sep 4, 2026	MIT License
Palo Alto - potential beaconing detected	Low	—	Sep 4, 2026	MIT License
Testing Usage of Uncommonly Used Port	Medium	SigmaHQ	Sep 4, 2026	Detection Rule License 1.1
Fortinet - Beacon pattern detected	Low	Microsoft Sentinel analytics	Sep 2, 2026	MIT License
Potential beaconing detected (ASIM Web Session)	Unknown	Microsoft Sentinel analytics	Sep 1, 2026	MIT License
Potential beaconing detected - Similar sent bytes (ASIM Web Session)	Unknown	Microsoft Sentinel analytics	Sep 1, 2026	MIT License
Beaconing traffic based on common user agents visiting limited number of domains (ASIM Web Session)	Unknown	Microsoft Sentinel analytics	Sep 1, 2026	MIT License
Ubiquiti - Top firewall rules	Medium	Microsoft Sentinel analytics	Sep 1, 2026	MIT License
Ubiquiti - Top blocked sources	Medium	Microsoft Sentinel analytics	Sep 1, 2026	MIT License
Ubiquiti - Top blocked internal services	Medium	Microsoft Sentinel analytics	Sep 1, 2026	MIT License
Ubiquiti - Rare internal ports	Medium	Microsoft Sentinel analytics	Sep 1, 2026	MIT License
Ubiquiti - Connection to known malicious IP or C2	Medium	Microsoft Sentinel analytics	Sep 1, 2026	MIT License
Ubiquiti - Possible connection to cryptominning pool	Medium	Microsoft Sentinel analytics	Sep 1, 2026	MIT License
Potential beaconing activity (ASIM Network Session schema)	Low	Microsoft Sentinel analytics	Sep 1, 2026	MIT License
GSA - Detect Protocol Changes for Destination Ports	Medium	Microsoft Sentinel analytics	Sep 1, 2026	MIT License
GSA - Detect Abnormal Deny Rate for Source to Destination IP	Medium	Microsoft Sentinel analytics	Sep 1, 2026	MIT License
Potential beaconing activity (ASIM DNS Solution)	Unknown	Microsoft Sentinel analytics	Sep 1, 2026	MIT License

Showing 25 of 42

Filter in the catalogue

External references

mitre-attackT1571Open reference

University of Birmingham C2Open reference

Symantec Elfin Mar 2019Open reference

change_rdp_port_contiOpen reference

Fortinet Agent Tesla April 2018Open reference

Platforms

ESXiLinuxmacOSWindows

Kill chain phases

command-and-control

Relationships

Incoming and outgoing edges in the selected ATT&CK release.

Incoming and outgoing edges in the selected ATT&CK release
Direction	Type	Related object