Adversaries may use non-standard ports to exfiltrate information.
| ID | Name | Description |
|---|---|---|
| S0480 | Cerberus | |
| S0405 | Exodus |
Exodus Two attempts to connect to port 22011 to provide a remote reverse shell.[2] |
| S0408 | FlexiSpy |
FlexiSpy can communicate with the command and control server over ports 12512 and 12514.[3] |
| S0463 | INSOMNIA |
INSOMNIA has communicated with the C2 over TCP ports 43111, 43223, and 43773.[4] |
| S0485 | Mandrake |
Mandrake has communicated with the C2 server over TCP port 7777.[5] |
| S0539 | Red Alert 2.0 |
Red Alert 2.0 has communicated with the C2 over port 7878.[6] |
| ID | Mitigation | Description |
|---|---|---|
| M1005 | Application Vetting |
Application vetting reports may show network communications performed by the application, including hosts, ports, protocols, and URLs. |
Detection would most likely be at the enterprise level, through packet and/or netflow inspection. Many properly configured firewalls may also naturally block command and control traffic over non-standard ports.