DET0706 Detection of Non-Standard Port

Technique Detected: T1509 (Non-Standard Port)

Analytics

Android

AN1827

Many properly configured firewalls may also naturally block command and control traffic over non-standard ports. Application vetting reports may show network communications performed by the application, including hosts, ports, protocols, and URLs. Further detection would most likely be at the enterprise level, through packet and/or netflow inspection.

Log Sources

Mutable Elements

iOS

AN1828

Many properly configured firewalls may also naturally block command and control traffic over non-standard ports. Application vetting reports may show network communications performed by the application, including hosts, ports, protocols, and URLs. Further detection would most likely be at the enterprise level, through packet and/or netflow inspection.

Log Sources

Mutable Elements