Adversaries may communicate over a commonly used port to bypass firewalls or network detection systems and to blend with normal network activity to avoid more detailed inspection.
They may use commonly open ports such as
They may use the protocol associated with the port or a completely different protocol.
| ID | Name | Description |
|---|---|---|
| S0182 | FinFisher |
FinFisher exfiltrates data over commonly used ports, such as ports 21, 53, and 443.[1] |
| S0485 | Mandrake |
Mandrake has communicated with the C2 server over TCP port 443.[2] |
This type of attack technique cannot be easily mitigated with preventive controls since it is based on the abuse of system features.