Thanks to all of our ATT&CKcon participants. All sessions are here, and individual presentations will be posted soon.

Commonly Used Port

Adversaries may communicate over a commonly used port to bypass firewalls or network detection systems and to blend with normal network activity to avoid more detailed inspection. They may use commonly open ports such as

  • TCP:80 (HTTP)
  • TCP:443 (HTTPS)
  • TCP:25 (SMTP)
  • TCP/UDP:53 (DNS)

They may use the protocol associated with the port or a completely different protocol.

For connections that occur internally within an enclave (such as those between a proxy or pivot node and other nodes), examples of common ports are

  • TCP/UDP:135 (RPC)
  • TCP/UDP:22 (SSH)
  • TCP/UDP:3389 (RDP)
ID: T1043

Tactic: Command And Control

Platform:  Linux, macOS, Windows

Data Sources:  Packet capture, Netflow/Enclave netflow, Process use of network, Process monitoring

Requires Network:  Yes

Version: 1.0

Examples

NameDescription
ADVSTORESHELL

A variant of ADVSTORESHELL attempts communication to the C2 server over HTTP on port 443.[1]

APT19

APT19 used TCP port 80 for C2.[2]

APT3

APT3 uses commonly used ports (like HTTPS/443) for command and control.[3]

APT37

APT37 has used port 8080 for C2.[4]

BADCALL

BADCALL uses port 8000 and 443 for C2.[5]

BBSRAT

BBSRAT uses HTTP TCP port 80 and HTTPS TCP port 443 for communications.[6]

Bisonal

Bisonal uses 443 for C2 communications.[7]

Briba

Briba connects to external C2 infrastructure over port 443.[8]

Calisto

Calisto attempted to contact the C2 server over TCP using port 80.[9]

Carbanak

Carbanak uses Port Numbers 443 and 80 for the C2 server.[10]

Cobalt Strike

Cobalt Strike uses a custom command and control protocol that communicates over commonly used ports. The C2 protocol is encapsulated in common application layer protocols.[11]

Comnie

Comnie uses Port Numbers 80, 8080, 8000, and 443 for communication to the C2 servers.[12]

Derusbi

Derusbi beacons to destination port 443.[13]

Dragonfly 2.0

Dragonfly 2.0 used SMB over ports 445 or 139 for C2. The group also established encrypted connections over port 443.[14][15]

Duqu

Duqu uses a custom command and control protocol that communicates over commonly used ports, and is frequently encapsulated by application layer protocols.[16]

ELMER

ELMER uses HTTP over port 443 for command and control.[17]

EvilGrab

EvilGrab uses port 8080 for C2.[18]

FELIXROOT

FELIXROOT uses port 443 for C2 communications.[19]

FIN7

FIN7 has used ports 53, 80, 443, and 8080 for C2.[20]

FIN8

FIN8 has tunneled RDP backdoors over port 443.[21]

FTP

FTP operates over ports 21 and 20.[22]

HARDRAIN

HARDRAIN binds and listens on port 443.[23]

Hi-Zor

Hi-Zor communicates with its C2 server over port 443.[24]

HTTPBrowser

One HTTPBrowser variant connected to its C2 server over port 8080.[25]

InvisiMole

InvisiMole uses port 80 for C2.[26]

KEYMARBLE

KEYMARBLE uses port 443 for C2.[27]

Lazarus Group

Some Lazarus Group malware uses a list of ordered port numbers to choose a port for C2 traffic, which includes commonly used ports such as 443, 53, 80, 25, and 8080.[28][29]

LOWBALL

LOWBALL command and control occurs via HTTPS over port 443.[30]

Magic Hound

Magic Hound malware has communicated with C2 servers over port 6667 (for IRC) and port 8080.[31]

MirageFox

MirageFox uses port 80 for C2.[32]

Mis-Type

Mis-Type communicates over common ports such as TCP 80, 443, and 25.[33]

Misdat

Misdat network traffic communicates over common ports like 80, 443, or 1433.[33]

Mivast

Mivast communicates over port 80 for C2.[34]

MoonWind

MoonWind communicates over ports 80, 443, 53, and 8080 via raw sockets instead of the protocols usually associated with the ports.[35]

Naid

Naid connects to external C2 infrastructure over port 443.[36]

Nidiran

Nidiran communicates with its C2 domain over ports 443 and 8443.[37]

Pasam

Pasam connects to external C2 infrastructure and opens a backdoor over port 443.[38]

PlugX

PlugX has beaconed to its C2 over port 443.[18]

PowerDuke

PowerDuke connects over 443 for C2.[39]

POWERSTATS

POWERSTATS has used port 80 for C2.[40]

Proxysvc

Proxysvc uses port 443 for the control server communications.[41]

RATANKBA

RATANKBA uses port 443 for C2.[42]

RedLeaves

RedLeaves uses a specific port of 443 and can also use ports 53 and 80 for C2. One RedLeaves variant uses HTTP over port 443 to connect to its C2 server.[18][43]

RIPTIDE

RIPTIDE is a RAT that communicates with HTTP.[44]

S-Type

S-Type uses ports 80, 443, and 8080 for C2.[33]

Shamoon

Shamoon has used TCP port 8080 for C2.[45]

Threat Group-3390

C2 traffic for most Threat Group-3390 tools occurs over Port Numbers 53, 80, and 443.[46]

TrickBot

TrickBot uses port 443 for C2 communications.[47][48]

TYPEFRAME

TYPEFRAME variants can use ports 443, 8443, and 8080 for communications.[49]

Volgmer

Some Volgmer variants use ports 8080 and 8000 for C2.[50][51][52]

Wiarp

Wiarp connects to external C2 infrastructure over the HTTP port.[53]

Mitigation

Network intrusion detection and prevention systems that use network signatures to identify traffic for specific adversary malware can be used to mitigate activity at the network level. Signatures are often for unique indicators within protocols and may be based on the specific protocol used by a particular adversary or tool, and will likely be different across various malware families and versions. Adversaries will likely change tool C2 signatures over time or construct protocols in such a way as to avoid detection by common defensive tools. [54]

Detection

Analyze network data for uncommon data flows (e.g., a client sending significantly more data than it receives from a server). Processes utilizing the network that do not normally have network communication or have never been seen before are suspicious. Analyze packet contents to detect communications that do not follow the expected protocol behavior for the port that is being used. [54]

References

  1. Bitdefender. (2015, December). APT28 Under the Scope. Retrieved February 23, 2017.
  2. Ahl, I. (2017, June 06). Privileges and Credentials: Phished at the Request of Counsel. Retrieved May 17, 2018.
  3. Yates, M. (2017, June 18). APT3 Uncovered: The code evolution of Pirpi. Retrieved September 28, 2017.
  4. Raiu, C., and Ivanov, A. (2016, June 17). Operation Daybreak. Retrieved February 15, 2018.
  5. US-CERT. (2018, February 06). Malware Analysis Report (MAR) - 10135536-G. Retrieved June 7, 2018.
  6. Lee, B. Grunzweig, J. (2015, December 22). BBSRAT Attacks Targeting Russian Organizations Linked to Roaming Tiger. Retrieved August 19, 2016.
  7. Hayashi, K., Ray, V. (2018, July 31). Bisonal Malware Used in Attacks Against Russia and South Korea. Retrieved August 7, 2018.
  8. Ladley, F. (2012, May 15). Backdoor.Briba. Retrieved February 21, 2018.
  9. Kuzin, M., Zelensky S. (2018, July 20). Calisto Trojan for macOS. Retrieved September 7, 2018.
  10. Bennett, J., Vengerik, B. (2017, June 12). Behind the CARBANAK Backdoor. Retrieved June 11, 2018.
  11. Strategic Cyber LLC. (2017, March 14). Cobalt Strike Manual. Retrieved May 24, 2017.
  12. Grunzweig, J. (2018, January 31). Comnie Continues to Target Organizations in East Asia. Retrieved June 7, 2018.
  13. Fidelis Cybersecurity. (2016, February 29). The Turbo Campaign, Featuring Derusbi for 64-bit Linux. Retrieved March 2, 2016.
  14. US-CERT. (2018, March 16). Alert (TA18-074A): Russian Government Cyber Activity Targeting Energy and Other Critical Infrastructure Sectors. Retrieved June 6, 2018.
  15. US-CERT. (2017, October 20). Alert (TA17-293A): Advanced Persistent Threat Activity Targeting Energy and Other Critical Infrastructure Sectors. Retrieved November 2, 2017.
  16. Symantec Security Response. (2011, November). W32.Duqu: The precursor to the next Stuxnet. Retrieved September 17, 2015.
  17. Winters, R.. (2015, December 20). The EPS Awakens - Part 2. Retrieved January 22, 2016.
  18. PwC and BAE Systems. (2017, April). Operation Cloud Hopper: Technical Annex. Retrieved April 13, 2017.
  19. Patil, S. (2018, June 26). Microsoft Office Vulnerabilities Used to Distribute FELIXROOT Backdoor in Recent Campaign. Retrieved July 31, 2018.
  20. Carr, N., et al. (2018, August 01). On the Hunt for FIN7: Pursuing an Enigmatic and Evasive Global Criminal Operation. Retrieved August 23, 2018.
  21. Elovitz, S. & Ahl, I. (2016, August 18). Know Your Enemy: New Financially-Motivated & Spear-Phishing Group. Retrieved February 26, 2018.
  22. Wikipedia. (2016, June 15). File Transfer Protocol. Retrieved July 20, 2016.
  23. US-CERT. (2018, February 05). Malware Analysis Report (MAR) - 10135536-F. Retrieved June 11, 2018.
  24. Fidelis Cybersecurity. (2015, December 16). Fidelis Threat Advisory #1020: Dissecting the Malware Involved in the INOCNATION Campaign. Retrieved March 24, 2016.
  25. Desai, D.. (2015, August 14). Chinese cyber espionage APT group leveraging recently leaked Hacking Team exploits to target a Financial Services Firm. Retrieved January 26, 2016.
  26. Hromcová, Z. (2018, June 07). InvisiMole: Surprisingly equipped spyware, undercover since 2013. Retrieved July 10, 2018.
  27. US-CERT. (2018, August 09). MAR-10135536-17 – North Korean Trojan: KEYMARBLE. Retrieved August 16, 2018.
  1. Novetta Threat Research Group. (2016, February 24). Operation Blockbuster: Unraveling the Long Thread of the Sony Attack. Retrieved February 25, 2016.
  2. Novetta Threat Research Group. (2016, February 24). Operation Blockbuster: Remote Administration Tools & Content Staging Malware Report. Retrieved March 16, 2016.
  3. FireEye Threat Intelligence. (2015, December 1). China-based Cyber Threat Group Uses Dropbox for Malware Communications and Targets Hong Kong Media Outlets. Retrieved December 4, 2015.
  4. Lee, B. and Falcone, R. (2017, February 15). Magic Hound Campaign Attacks Saudi Targets. Retrieved December 27, 2017.
  5. Rosenberg, J. (2018, June 14). MirageFox: APT15 Resurfaces With New Tools Based On Old Ones. Retrieved September 21, 2018.
  6. Gross, J. (2016, February 23). Operation Dust Storm. Retrieved September 19, 2017.
  7. Stama, D.. (2015, February 6). Backdoor.Mivast. Retrieved February 15, 2016.
  8. Miller-Osborn, J. and Grunzweig, J.. (2017, March 30). Trochilus and New MoonWind RATs Used In Attack Against Thai Organizations. Retrieved March 30, 2017.
  9. Neville, A. (2012, June 15). Trojan.Naid. Retrieved February 22, 2018.
  10. DiMaggio, J.. (2016, May 17). Indian organizations targeted in Suckfly attacks. Retrieved August 3, 2016.
  11. Mullaney, C. & Honda, H. (2012, May 4). Trojan.Pasam. Retrieved February 22, 2018.
  12. Adair, S.. (2016, November 9). PowerDuke: Widespread Post-Election Spear Phishing Campaigns Targeting Think Tanks and NGOs. Retrieved January 11, 2017.
  13. Lancaster, T.. (2017, November 14). Muddying the Water: Targeted Attacks in the Middle East. Retrieved March 15, 2018.
  14. Sherstobitoff, R., Malhotra, A. (2018, April 24). Analyzing Operation GhostSecret: Attack Seeks to Steal Data Worldwide. Retrieved May 16, 2018.
  15. Trend Micro. (2017, February 27). RATANKBA: Delving into Large-scale Watering Holes against Enterprises. Retrieved May 22, 2018.
  16. Accenture Security. (2018, April 23). Hogfish Redleaves Campaign. Retrieved July 2, 2018.
  17. Moran, N., Oppenheim, M., Engle, S., & Wartell, R.. (2014, September 3). Darwin’s Favorite APT Group [Blog]. Retrieved November 12, 2014.
  18. Falcone, R.. (2016, November 30). Shamoon 2: Return of the Disttrack Wiper. Retrieved January 11, 2017.
  19. Dell SecureWorks Counter Threat Unit Threat Intelligence. (2015, August 5). Threat Group-3390 Targets Organizations for Cyberespionage. Retrieved August 18, 2018.
  20. Salinas, M., Holguin, J. (2017, June). Evolution of Trickbot. Retrieved July 31, 2018.
  21. Antazo, F. (2016, October 31). TSPY_TRICKLOAD.N. Retrieved September 14, 2018.
  22. US-CERT. (2018, June 14). MAR-10135536-12 – North Korean Trojan: TYPEFRAME. Retrieved July 13, 2018.
  23. US-CERT. (2017, November 22). Alert (TA17-318B): HIDDEN COBRA – North Korean Trojan: Volgmer. Retrieved December 7, 2017.
  24. US-CERT. (2017, November 01). Malware Analysis Report (MAR) - 10135536-D. Retrieved July 16, 2018.
  25. Yagi, J. (2014, August 24). Trojan.Volgmer. Retrieved July 16, 2018.
  26. Zhou, R. (2012, May 15). Backdoor.Wiarp. Retrieved February 22, 2018.
  27. Gardiner, J., Cova, M., Nagaraja, S. (2014, February). Command & Control Understanding, Denying and Detecting. Retrieved April 20, 2016.