Commonly Used Port

Adversaries may communicate over a commonly used port to bypass firewalls or network detection systems and to blend with normal network activity to avoid more detailed inspection. They may use commonly open ports such as

TCP:80 (HTTP)
TCP:443 (HTTPS)
TCP:25 (SMTP)
TCP/UDP:53 (DNS)

They may use the protocol associated with the port or a completely different protocol.

For connections that occur internally within an enclave (such as those between a proxy or pivot node and other nodes), examples of common ports are

TCP/UDP:135 (RPC)
TCP/UDP:22 (SSH)
TCP/UDP:3389 (RDP)

ID: T1043

Tactic: Command And Control

Platform: Linux, macOS, Windows

Data Sources: Packet capture, Netflow/Enclave netflow, Process use of network, Process monitoring

Requires Network: Yes

Version: 1.0

Examples

Name	Description
ADVSTORESHELL	A variant of ADVSTORESHELL attempts communication to the C2 server over HTTP on port 443.^[1]
APT18	APT18 uses port 80 for C2 communications.^[2]^[3]
APT19	APT19 used TCP port 80 for C2.^[4]
APT29	APT29 has used Port Number 443 for C2.^[5]
APT3	APT3 uses commonly used ports (like HTTPS/443) for command and control.^[6]
APT32	APT32 has used port 80 for C2 communications.^[7]^[8]
APT33	APT33 has used port 443 for command and control.^[9]
APT37	APT37 has used port 8080 for C2.^[10]
AuditCred	AuditCred has used Port Number 443 for C2 communications.^[11]
BADCALL	BADCALL uses port 8000 and 443 for C2.^[12]
BadPatch	BadPatch uses port 26 for C2 communications.^[13]
BBSRAT	BBSRAT uses HTTP TCP port 80 and HTTPS TCP port 443 for communications.^[14]
Bisonal	Bisonal uses 443 for C2 communications.^[15]
Briba	Briba connects to external C2 infrastructure over port 443.^[16]
Calisto	Calisto attempted to contact the C2 server over TCP using port 80.^[17]
Carbanak	Carbanak uses Port Numbers 443 and 80 for the C2 server.^[18]
Carbon	Carbon uses port 80 for C2 communications.^[19]
Cardinal RAT	Cardinal RAT is downloaded using HTTP over port 443.^[20]
Cobalt Strike	Cobalt Strike uses a custom command and control protocol that communicates over commonly used ports. The C2 protocol is encapsulated in common application layer protocols.^[21]
Comnie	Comnie uses Port Numbers 80, 8080, 8000, and 443 for communication to the C2 servers.^[22]
Denis	Denis uses port 53 for C2 communications.^[7]
Derusbi	Derusbi beacons to destination port 443.^[23]
Dragonfly 2.0	Dragonfly 2.0 used SMB over ports 445 or 139 for C2. The group also established encrypted connections over port 443.^[24]^[25]
Duqu	Duqu uses a custom command and control protocol that communicates over commonly used ports, and is frequently encapsulated by application layer protocols.^[26]
Ebury	Ebury has used UDP port 53 for C2. ^[27]
ELMER	ELMER uses HTTP over port 443 for command and control.^[28]
Emotet	Emotet has used ports 20, 22, 80, 443, 8080, and 8443.^[29]^[30]^[31]
Empire	Empire can conduct command and control over commonly used ports like 80 and 443.^[32]
EvilGrab	EvilGrab uses port 8080 for C2.^[33]
FELIXROOT	FELIXROOT uses Port Numbers 443, 8443, and 8080 for C2 communications.^[34]^[35]
FIN7	FIN7 has used ports 53, 80, 443, and 8080 for C2.^[36]
FIN8	FIN8 has tunneled RDP backdoors over port 443.^[37]
FTP	FTP operates over ports 21 and 20.^[38]
gh0st RAT	gh0st RAT uses port 443 for C2 communications.^[39]
HARDRAIN	HARDRAIN binds and listens on port 443.^[40]
Hi-Zor	Hi-Zor communicates with its C2 server over port 443.^[41]
HOPLIGHT	HOPLIGHT has connected outbound over TCP port 443. ^[42]
HTTPBrowser	One HTTPBrowser variant connected to its C2 server over port 8080.^[43]
InvisiMole	InvisiMole uses port 80 for C2.^[44]
KEYMARBLE	KEYMARBLE uses port 443 for C2.^[45]
Lazarus Group	Some Lazarus Group malware uses a list of ordered port numbers to choose a port for C2 traffic, which includes commonly used ports such as 443, 53, 80, 25, and 8080.^[46]^[47]
Linux Rabbit	Linux Rabbit checks to see if an SSH server is listening on port 22.^[48]
LOWBALL	LOWBALL command and control occurs via HTTPS over port 443.^[49]
Magic Hound	Magic Hound malware has communicated with C2 servers over port 6667 (for IRC) and port 8080.^[50]
MirageFox	MirageFox uses port 80 for C2.^[51]
Mis-Type	Mis-Type communicates over common ports such as TCP 80, 443, and 25.^[52]
Misdat	Misdat network traffic communicates over common ports like 80, 443, or 1433.^[52]
Mivast	Mivast communicates over port 80 for C2.^[53]
MoonWind	MoonWind communicates over ports 80, 443, 53, and 8080 via raw sockets instead of the protocols usually associated with the ports.^[54]
Naid	Naid connects to external C2 infrastructure over port 443.^[55]
Nidiran	Nidiran communicates with its C2 domain over ports 443 and 8443.^[56]
Night Dragon	Night Dragon has used ports 25 and 80 for C2 communications.^[57]
OceanSalt	OceanSalt uses Port Number 8080 for C2.^[58]
Pasam	Pasam connects to external C2 infrastructure and opens a backdoor over port 443.^[59]
PlugX	PlugX has beaconed to its C2 over port 443.^[33]^[60]
PowerDuke	PowerDuke connects over 443 for C2.^[61]
POWERSTATS	POWERSTATS has used port 80 for C2.^[62]
POWERTON	POWERTON has used port 443 for C2 traffic. ^[9]
Proxysvc	Proxysvc uses port 443 for the control server communications.^[63]
RATANKBA	RATANKBA uses port 443 for C2.^[64]
RedLeaves	RedLeaves uses a specific port of 443 and can also use ports 53 and 80 for C2. One RedLeaves variant uses HTTP over port 443 to connect to its C2 server.^[33]^[65]
RIPTIDE	RIPTIDE is a RAT that communicates with HTTP.^[66]
S-Type	S-Type uses ports 80, 443, and 8080 for C2.^[52]
Shamoon	Shamoon has used TCP port 8080 for C2.^[67]
TEMP.Veles	TEMP.Veles has used port 443 for C2.^[68]
Threat Group-3390	C2 traffic for most Threat Group-3390 tools occurs over Port Numbers 53, 80, and 443.^[69]
TrickBot	TrickBot uses port 443 for C2 communications.^[70]^[71]
Tropic Trooper	Tropic Trooper can use ports 443 and 53 for C2 communications via malware called TClient.^[72]
TYPEFRAME	TYPEFRAME variants can use ports 443, 8443, and 8080 for communications.^[73]
UBoatRAT	UBoatRAT uses ports 80 and 443 for C2 communications.^[74]
Volgmer	Some Volgmer variants use ports 8080 and 8000 for C2.^[75]^[76]^[77]
Wiarp	Wiarp connects to external C2 infrastructure over the HTTP port.^[78]

Mitigation

Network intrusion detection and prevention systems that use network signatures to identify traffic for specific adversary malware can be used to mitigate activity at the network level. Signatures are often for unique indicators within protocols and may be based on the specific protocol used by a particular adversary or tool, and will likely be different across various malware families and versions. Adversaries will likely change tool C2 signatures over time or construct protocols in such a way as to avoid detection by common defensive tools. ^[79]

Detection

Analyze network data for uncommon data flows (e.g., a client sending significantly more data than it receives from a server). Processes utilizing the network that do not normally have network communication or have never been seen before are suspicious. Analyze packet contents to detect communications that do not follow the expected protocol behavior for the port that is being used. ^[79]

Commonly Used Port

Examples

Mitigation

Detection

References