H3XAOperational intelligence
Live analytical pictureEvidence before assessment
Threat intelligence / Technique

Non-Standard Port

Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088(Citation: Symantec Elfin Mar 2019) or port 587(Citation: Fortinet Agent Tesla April 2018) as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data. Adversaries may also make changes to victim systems to abuse non-standard ports. For example, Registry keys and other configuration settings can be used to modify protocol and port pairings.(Citation: change_rdp_port_conti)

Technique
TypeTechnique
External ID—
First seen2026-08-14
Last seen2026-08-14

Confidence

—

Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088(Citation: Symantec Elfin Mar 2019) or port 587(Citation: Fortinet Agent Tesla April 2018) as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data. Adversaries may also make changes to victim systems to abuse non-standard ports. For example, Registry keys and other configuration settings can be used to modify protocol and port pairings.(Citation: change_rdp_port_conti)

69 recorded

Relationships

mitigates
from Network Intrusion Prevention
Mitigation
mitigates
from Network Segmentation
Mitigation
revoked-by
from Uncommonly Used Port
Technique
uses
from 2025 Poland Wiper Attacks
Campaign
uses
from APT32
Group
uses
from APT33
Group
uses
from APT-C-36
Group
uses
from BADCALL
Malware
uses
from Bankshot
Malware
uses
from BeaverTail
Malware
uses
from BendyBear
Malware
uses
from C0018
Campaign
uses
from C0032
Campaign
uses
from Contagious Interview
Group
uses
from Covenant
Tool
uses
from Cyclops Blink
Malware
uses
from DarkVishnya
Group
uses
from Derusbi
Malware
uses
from Ember Bear
Group
uses
from Emotet
Malware
uses
from FIN7
Group
uses
from Gamaredon Group
Group
uses
from GlassWorm
Malware
uses
from GoldenSpy
Malware
uses
from GravityRAT
Malware
uses
from Hannotog
Malware
uses
from HARDRAIN
Malware
uses
from HiddenFace
Malware
uses
from HOPLIGHT
Malware
uses
from Indian Critical Infrastructure Intrusions
Campaign
uses
from InvisibleFerret
Malware
uses
from KV Botnet Activity
Campaign
uses
from Lazarus Group
Group
uses
from MacMa
Malware
uses
from Magic Hound
Group
uses
from Metamorfo
Malware
uses
from MoonWind
Malware
uses
from MuddyWater
Group
uses
from njRAT
Malware
uses
from Operation Wocao
Campaign
uses
from OSX_OCEANLOTUS.D
Malware
uses
from Pikabot
Malware
uses
from PingPull
Malware
uses
from PlugX
Malware
uses
from PoetRAT
Malware
uses
from Quad7 Activity
Campaign
uses
from QuasarRAT
Tool
uses
from Raspberry Robin
Malware
uses
from RedEcho
Group
uses
from RedLeaves
Malware
uses
from RedPenguin
Campaign
uses
from Rocke
Group
uses
from RotaJakiro
Malware
uses
from RTM
Malware
uses
from Sandworm Team
Group
uses
from Sardonic
Malware
uses
from Silence
Group
uses
from SPAWNCHIMERA
Malware
uses
from StrongPity
Malware
uses
from SUGARUSH
Malware
uses
from SystemBC
Malware
uses
from TrickBot
Malware
uses
from TYPEFRAME
Malware
uses
from Velvet Ant
Group
uses
from VIRTUALPIE
Malware
uses
from VIRTUALPITA
Malware
uses
from WellMail
Malware
uses
from WIRTE
Group
uses
from ZxShell
Malware
5 external

References

mitre-attack
T1571
open
University of Birmingham C2
https://arxiv.org/ftp/arxiv/papers/1408/1408.1136.pdf
open
Symantec Elfin Mar 2019
https://www.symantec.com/blogs/threat-intelligence/elfin-apt33-espionage
open
change_rdp_port_conti
https://x.com/TheDFIRReport/status/1498657772254240768
open
Fortinet Agent Tesla April 2018
https://www.fortinet.com/blog/threat-research/analysis-of-new-agent-tesla-spyware-variant.html
open
Continue into the dataIntelligence explorerHow to read the graphEvidence & provenance