T1205No distinct observable

Traffic Signaling

Stealth · Persistence · Command and ControlLinux, macOS, Network Devices, Windows

Where this stands

A reviewer read the telemetry and concluded there is nothing here to detect that a sibling technique does not already cover.

The parent brief is the port-knocking child's brief. AN1448/AN1449/AN1450 (DET0524) list the same log sources and the same knobs as AN0842/AN0843/AN0844 (DET0302) under T1205.001 — Sysmon EID 1/3/22, the microsoft-windows-windowsfirewallwithadvancedsecurity/firewall channel 2004/2005/2006, auditd execve of iptables/nft/ufw/firewall-cmd, auditd socket/bind, macOS pfctl/socketfilterfw — with TimeWindowKnock/PortSequenceMinLen/AllowedFirewallChangers matching the child's TimeWindow/MinSequenceLen/RuleChangeAllowList almost word for word, so anything authored here would be T1205.001's detection filed under the parent tag. The two things the parent adds beyond the knock are both unavailable. The 'already-open port that only responds to a magic value' case is the sniffer/BPF mechanism owned by T1205.002, which is already published in this corpus as an image_load rule on wpcap.dll/packet.dll. […]

Covered instead by T1205.001, T1205.002, T1686 (was T1562.004), T1040.

What the technique is

Adversaries may use traffic signaling to hide open ports or other malicious functionality used for persistence or command and control. Traffic signaling involves the use of a magic value or sequence that must be sent to a system to trigger a special response, such as opening a closed port or executing a malicious task. This may take the form of sending a series of packets with certain characteristics before a port will be opened that the adversary can use for command and control. Usually this series of packets consists of attempted connections to a predefined sequence of closed ports (i.e. Port Knocking), but can involve unusual flags, specific strings, or other unique characteristics. After the sequence is completed, opening a port may be accomplished by the host-based firewall, but could also be implemented by custom software. Adversaries may also communicate with an already open port, but the service listening on that port will only respond to commands or trigger other malicious functionality if passed the appropriate magic value(s). The observation of the signal packets to trigger the communication can be conducted through different methods. One means, originally implemented by Cd00r, is to use the libpcap libraries to sniff for the packets in question. […]

Read it on attack.mitre.org

What MITRE says you would watch

AN1448
A remote host sends a short sequence of failed connection attempts (RST/ICMP unreachable) to a set of closed ports. Within a brief window the endpoint (a) adds/enables a firewall rule or (b) a sniffer-backed process begins listening or opens a new socket, after which a successful connection occurs. Also detects Wake-on-LAN magic packets seen on local segment.
AN1449
Closed-port knock sequence from a remote IP followed by on-host firewall change (iptables/nftables) or daemon starts listening (socket open) and a successful TCP/UDP connect. Optional detection of libpcap/raw-socket sniffers spawning to watch for secret values.
AN1450
Remote knock sequence followed by PF/socketfilterfw rule update or a background process listening on a new port; then a successful TCP session. Also flags WoL magic packets on local segment.