Opening Forensia workspaceacquiring
Loading the current evidence view. Navigation and account controls remain available.
Loading recent evidenceacquiring
ATT&CK knowledge
Loading the current evidence view. Navigation and account controls remain available.
Tactics: command-and-control
17
known groups
41
software
1,001
corpus matches
about
Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088 or port 587 as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Adversaries may also make changes to victim systems to abuse non-standard ports. For example, Registry keys and other configuration settings can be used to modify protocol and port pairings.
used by actors
17 known groups
corpus indicators tagged T1571
1,001 carry this technique
A shared-technique signal for hunting: each row resolves to its own verdict. Not attribution to any one group.
software
41 malware & tools implement this
showing top 30 by severity of 1,001