Commonly Used Port
Where this stands
No Sigma rule can address this — the telemetry MITRE names has no Sigma logsource behind it.
Sigma has no logsource taxonomy for ICS. MITRE's telemetry here is operational historians and controller state, which no Sigma rule can address.
What the technique is
Adversaries may communicate over a commonly used port to bypass firewalls or network detection systems and to blend in with normal network activity, to avoid more detailed inspection. They may use the protocol associated with the port, or a completely different protocol. They may use commonly open ports, such as the examples provided below. TCP:80 (HTTP) TCP:443 (HTTPS) TCP/UDP:53 (DNS) TCP:1024-4999 (OPC on XP/Win2k3) TCP:49152-65535 (OPC on Vista and later) TCP:23 (TELNET) UDP:161 (SNMP) TCP:502 (MODBUS) TCP:102 (S7comm/ISO-TSAP) TCP:20000 (DNP3) TCP:44818 (Ethernet/IP)
Read it on attack.mitre.orgWhat MITRE says you would watch
- AN1869
Analyze network data for uncommon data flows (e.g., new protocols in use between hosts, unexpected ports in use). Processes utilizing the network that do not normally have network communication or have never been seen before are suspicious. Monitor for mismatches between protocols and their expected ports (e.g., non-HTTP traffic on tcp:80). Analyze packet contents to detect communications that do not follow the expected protocol behavior for the port that is being used.
Technique names and descriptions © MITRE ATT&CK®, CC BY 4.0. Not endorsed by MITRE.