Adversaries may generate network traffic using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088 or port 587 as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
| ID | Name | Description |
|---|---|---|
| S0480 | Cerberus |
Cerberus communicates with the C2 using HTTP requests over port 8888.[1] |
| S1083 | Chameleon | |
| S0405 | Exodus |
Exodus Two attempts to connect to port 22011 to provide a remote reverse shell.[3] |
| S0408 | FlexiSpy |
FlexiSpy can communicate with the command and control server over ports 12512 and 12514.[4] |
| S0463 | INSOMNIA |
INSOMNIA has communicated with the C2 using HTTPS requests over ports 43111, 43223, and 43773.[5] |
| S1185 | LightSpy |
LightSpy has communicated with the C2 using ports 52202, 51200, 43201, 43202, 43203, and 21202.[6] |
| S0485 | Mandrake |
Mandrake has communicated with the C2 server over TCP port 7777.[7] |
| S0539 | Red Alert 2.0 |
Red Alert 2.0 has communicated with the C2 using HTTP requests over port 7878.[8] |
This type of attack technique cannot be easily mitigated with preventive controls since it is based on the abuse of system features.
| ID | Name | Analytic ID | Analytic Description |
|---|---|---|---|
| DET0706 | Detection of Non-Standard Port | AN1827 |
The defender correlates app-attributed outbound sessions where protocol indicators such as TLS handshake, HTTP method and header patterns, DNS semantics, or other application-layer characteristics are observed over a destination port outside the approved baseline for that protocol and app role. The strongest Android evidence is repeated or persistent app-attributed traffic using HTTPS-, HTTP-, DNS-, WebSocket-, or other recognizable application behavior over uncommon destination ports, especially when the app is backgrounded, while the device is locked, without recent user interaction, or when the app is unmanaged or not approved for that protocol-to-port pairing. |
| AN1828 |
The defender correlates managed-app or supervised-device outbound sessions where protocol indicators such as TLS handshake, HTTP semantics, or other application-layer behaviors are observed over destination ports outside the approved baseline for that protocol and bundle role. The strongest iOS evidence is network telemetry showing repeated or persistent sessions using recognizable application protocols over uncommon ports, particularly during background refresh, while the device is locked, or without recent user interaction. Because direct local runtime attribution is weaker than Android, the primary iOS analytic should be anchored on network protocol-versus-port mismatch plus supervised managed-app context and device-state enrichment. |