Bidda Sovereign Intelligence · 10,085 Verified Nodes · 39 Sovereign Pillars

MITRE ATT&CK T1571: Non-Standard Port (Enterprise Tactic TA0011 - Command and Control)

MITRE ATT&CK T1571 (Non-Standard Port) is an Enterprise Command and Control technique. Adversaries may communicate using a protocol and port pairing that…

What MITRE ATT&CK T1571: Non-Standard Port (Enterprise Tactic TA0011 - Command and Control) requires

MITRE ATT&CK T1571 (Non-Standard Port) is an Enterprise Command and Control technique. Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088 or port 587 as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data. Adversaries may also make changes to victim systems to abuse non-standard ports. For example, Registry keys and other configuration settings can be used to modify protocol and port pairings. Affected platforms: Linux, macOS, Windows. MITRE-documented mitigations include M1030 Network Segmentation, M1031 Network Intrusion Prevention. The Center for Threat-Informed Defense maps this technique to NIST SP 800-53 Rev 5 controls AC-04, CA-07, CM-02, CM-06, CM-07, SC-07, SI-03, SI-04.

Pillar: Cybersecurity · Authority: MITRE Corporation · Version: 1.0.0 · Last updated:

Primary source: https://attack.mitre.org/techniques/T1571/

SHA-256 integrity: 187ec6571481d1f38d4228543917b3174984d9fbbb8903157b7763c3dec79087

Primary Citations — 7 traced to source

  • MITRE ATT&CK Technique T1571: Non-Standard Port (https://attack.mitre.org/techniques/T1571/)
  • MITRE ATT&CK Tactic TA0011: Command and Control (https://attack.mitre.org/tactics/TA0011/)

+ 5 more citations (full bibliography, deterministic workflow, actionable schema and crosswalks) included in the vault unlock — $0.01 via Skyfire / L402 / Direct Base USDC.

Access

⚠ Important: Human Verification Required

Bidda compliance nodes are reference intelligence, not legal advice. Every node must be reviewed by a qualified compliance professional or legal counsel before implementation in any enterprise workflow, regulated system, or compliance programme. See bidda.com/disclaimer for full terms.