T1571 — Non-Standard Port

# T1571 - Non-Standard Port

## SOC Recommendation
Investigate Non-Standard Port activity in the context of Command and Control: confirm scope, affected host/identity, and whether it matches expected administrative behaviour before deciding this is benign.

## D3FEND Mappings
| D3FEND Technique | Relationship | Practical SOC Action |
|---|---|---|
| User Geolocation Logon Pattern Analysis | Detect | Monitor for User Geolocation Logon Pattern Analysis indicators relevant to this technique. |
| Network Traffic Filtering | Isolate | Apply Network Traffic Filtering to contain the blast radius once this technique is observed. |

## Investigation Steps
1. Review Defender for Endpoint / Defender XDR alerts and timeline for the affected host or identity.
2. Check Sentinel analytics rules and incidents correlated with this technique.
3. Review Entra ID sign-in and audit logs if the technique involves an identity or cloud resource.

## Evidence to Collect
- Host or resource affected
- Account or identity involved
- Timestamp of the activity
- Related process, file, or network artifact
- Any preceding or follow-on alerts

## Response Actions
| Action | Risk | Automation Safe | Approval Required |
|---|---|---|---|
| Submit destination IP to VirusTotal and Shodan | Low | Yes | No |
| Block destination IP if confirmed malicious | Medium | No | Yes |
| Identify the process making the connection (MDE DeviceNetwor | Low | No | Yes |

## KQL
```kql
let StandardPorts = dynamic([80, 443, 8080, 8443, 53, 25, 587, 465, 110, 995, 143, 993, 21, 22, 23, 3389, 445, 3306, 5432, 1433, 27017]);
let KnownBadPorts = dynamic([4444, 4445, 31337, 8888, 9001, 9030, 6666, 7777, 1234]);
DeviceNetworkEvents
| where TimeGenerated >= ago(1h)
| where ActionType == "ConnectionSuccess"
| where RemotePort !in (StandardPorts)
| where RemotePort between (1024 .. 65535)
| where not(RemoteIP has_any ("10.", "192.168.", "172.16.", "172.17.", "172.18.", "172.19.",
    "172.20.", "172.21.", "172.22.", "172.23.", "172.24.", "172.25.", "172.26.", "172.27.",
    "172.28.", "172.29.", "172.30.", "172.31."))
| summarize
    ConnCount = count(),
    DistinctPorts = dcount(RemotePort),
    Ports = make_set(RemotePort, 20)
    by DeviceName, RemoteIP, InitiatingProcessFileName
| where ConnCount > 5
| extend KnownBadPort = set_has_element(Ports, KnownBadPorts)
| extend timestamp = now(), HostCustomEntity = DeviceName, IPCustomEntity = RemoteIP
| order by KnownBadPort desc, ConnCount desc
```
```kql
ContrastADRAttackEvents_CL
| where result =~ "EXPLOITED" and rule =~ "SQL-INJECTION"
| project-rename hostname = host_hostname
//please add your DLP logs table in place of ContrastWAFLogs_CL and hostname colomun in place of hostname below and uncomment the queries below
//| join kind= inner (ContrastWAFLogs_CL | where TimeGenerated >= ago(5m)) on hostname
```
```kql
let LearningPeriod = 7d;
let RunTime = 1h;
let StartLearningPeriod = LearningPeriod + RunTime;
let DetectionWindowStart = ago(RunTime);
let LearningPortToProtocol1 =  (AzureDiagnostics
| where TimeGenerated between (ago(StartLearningPeriod) .. ago(RunTime))
| where OperationName == "AzureFirewallApplicationRuleLog"
| extend msg_s= column_ifexists('msg_s',Message)
| parse msg_s with Protocol " request from " SourceIp ":" SourcePort:int " to " Fqdn ":" DestinationPort:int "." *
| where isnotempty(DestinationPort)
| summarize LearningTimeCount = count() by LearningTimeDstPort = DestinationPort, LearningTimeProtocol = Protocol, SourceIp, Fqdn);
let LearningPortToProtocol2 = (AZFWNetworkRule
| where TimeGenerated between (ago(StartLearningPeriod) .. ago(RunTime))
| where isnotempty(DestinationPort)
| extend Fqdn = DestinationIp
| summarize LearningTimeCount = count() by LearningTimeDstPort = DestinationPort, LearningTimeProtocol = Protocol, SourceIp, Fqdn);
let LearningPortToProtocol3 = (AZFWApplicationRule
| where TimeGenerated between (ago(StartLearningPeriod) .. ago(RunTime))
| where isnotempty(DestinationPort)
| summarize LearningTimeCount = count() by LearningTimeDstPort = DestinationPort, LearningTimeProtocol = Protocol, SourceIp, Fqdn);
let AlertTimePortToProtocol1 = (AzureDiagnostics
| where TimeGenerated between (DetectionWindowStart .. now())
| where OperationName == "AzureFirewallApplicationRuleLog"
| extend msg_s= column_ifexists('msg_s',Message)
| parse msg_s with Protocol " request from " SourceIp ":" SourcePort " to " Fqdn ":" DestinationPort:int "." *
| where isnotempty(DestinationPort)
| summarize AlertTimeCount = count() by AlertTimeDstPort = DestinationPort, AlertTimeProtocol = Protocol);
let AlertTimePortToProtocol2 = (AZFWNetworkRule
| where TimeGenerated between (DetectionWindowStart .. now())
| where isnotempty(DestinationPort)
| extend Fqdn = DestinationIp
| summarize AlertTimeCount = count() by AlertTimeDstPort = DestinationPort, AlertTimeProtocol = Protocol);
let AlertTimePortToProtocol3 = (AZFWApplicationRule
| where TimeGenerated between (DetectionWindowStart .. now())
| where isnotempty(DestinationPort)
| summarize AlertTimeCount = count() by AlertTimeDstPort = DestinationPort, AlertTimeProtocol = Protocol);
(union isfuzzy=true 
(AlertTimePortToProtocol1 
| join kind=leftouter (LearningPortToProtocol1) on $left.AlertTimeDstPort == $right.LearningTimeDstPort
| where LearningTimeProtocol != AlertTimeProtocol),
(AlertTimePortToProtocol2 
| join kind=leftouter (LearningPortToProtocol2) on $left.AlertTimeDstPort == $right.LearningTimeDstPort
| where LearningTimeProtocol != AlertTimeProtocol),
(AlertTimePortToProtocol3 
| join kind=leftouter (LearningPortToProtocol3) on $left.AlertTimeDstPort == $right.LearningTimeDstPort
| where LearningTimeProtocol != AlertTimeProtocol))
```

## Escalation Criteria
- Non-Standard Port activity observed on a privileged account or critical system.
- Activity follows or precedes other suspicious behaviour in the same investigation.
- Automated triage cannot confidently rule out malicious intent.

## False Positive Considerations
- Legitimate administrative or maintenance activity matching this pattern.
- Approved security testing or red team exercise.
- Known benign software producing similar telemetry.

Generated by SOC Response Atlas by Basyrix.

Want to push this directly to Confluence? Upgrade to Basyrix Pro.

• /api/techniques/T1571.json
• /api/recommendations/T1571.json
• /api/d3fend/T1571.json
• /api/mappings/T1571.json
• /api/confluence/T1571.md

Example curl:

curl https://atlas.basyrix.com/api/recommendations/T1571.json

Response:

{
  "technique_id": "T1571",
  "name": "Non-Standard Port",
  "priority": "medium",
  "status": "complete",
  "version": "0.1.0",
  "last_reviewed": "2026-07-23",
  "generated_by": "SOC Response Atlas by Basyrix",
  "tactics": [
    "Command and Control"
  ],
  "platforms": [
    "ESXi",
    "Linux",
    "macOS",
    "Windows"
  ],
  "summary": "Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088 or port 587 as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data. Adversaries may also make changes to victim systems to abuse non-standard ports...",
  "soc_recommendation": "Investigate Non-Standard Port activity in the context of Command and Control: confirm scope, affected host/identity, and whether it matches expected administrative behaviour before deciding this is benign.",
  "d3fend_mappings": [
    {
      "id": "D3-UGLPA",
      "name": "User Geolocation Logon Pattern Analysis",
      "relationship": "detect",
      "practical_action": "Monitor for User Geolocation Logon Pattern Analysis indicators relevant to this technique.",
      "tooling": [
        "Defender for Endpoint"
      ]
    },
    {
      "id": "D3-NTF",
      "name": "Network Traffic Filtering",
      "relationship": "isolate",
      "practical_action": "Apply Network Traffic Filtering to contain the blast radius once this technique is observed.",
      "tooling": [
        "Sentinel",
        "Defender for Endpoint"
      ]
    }
  ],
  "investigation_steps": {
    "microsoft": [
      "Review Defender for Endpoint / Defender XDR alerts and timeline for the affected host or identity.",
      "Check Sentinel analytics rules and incidents correlated with this technique.",
      "Review Entra ID sign-in and audit logs if the technique involves an identity or cloud resource."
    ],
    "generic": [
      "Confirm whether the observed non-standard port activity matches expected administrative or application behaviour.",
      "Identify the host, account, or resource where the activity occurred and its business criticality.",
      "Check for related alerts before and after this activity to reconstruct the broader intrusion timeline.",
      "Real detection reference: \"Communication on Non-Standard Port\" -- Flags outbound connections from a device to an external IP on an unusual, non-well-known port, including known default C2 ports (Metasploit, common RAT defaults)."
    ]
  },
  "evidence_to_collect": [
    "Host or resource affected",
    "Account or identity involved",
    "Timestamp of the activity",
    "Related process, file, or network artifact",
    "Any preceding or follow-on alerts"
  ],
  "response_actions": [
    {
      "name": "Submit destination IP to VirusTotal and Shodan",
      "category": "Response",
      "risk": "Low",
      "automation_safe": true,
      "approval_required": false,
      "tool": "See investigation guide"
    },
    {
      "name": "Block destination IP if confirmed malicious",
      "category": "Response",
      "risk": "Medium",
      "automation_safe": false,
      "approval_required": true,
      "tool": "See investigation guide"
    },
    {
      "name": "Identify the process making the connection (MDE DeviceNetwor",
      "category": "Response",
      "risk": "Low",
      "automation_safe": false,
      "approval_required": true,
      "tool": "Defender for Endpoint",
      "notes": "Identify the process making the connection (MDE DeviceNetworkEvents)"
    }
  ],
  "queries": {
    "kql": [
      {
        "name": "GEN-CC-005 — Communication on Non-Standard Port",
        "description": "Flags outbound connections from a device to an external IP on an unusual, non-well-known port, including known default C2 ports (Metasploit, common RAT defaults). (Source: Bell Integration baseline detection library.)",
        "query": "let StandardPorts = dynamic([80, 443, 8080, 8443, 53, 25, 587, 465, 110, 995, 143, 993, 21, 22, 23, 3389, 445, 3306, 5432, 1433, 27017]);\nlet KnownBadPorts = dynamic([4444, 4445, 31337, 8888, 9001, 9030, 6666, 7777, 1234]);\nDeviceNetworkEvents\n| where TimeGenerated >= ago(1h)\n| where ActionType == \"ConnectionSuccess\"\n| where RemotePort !in (StandardPorts)\n| where RemotePort between (1024 .. 65535)\n| where not(RemoteIP has_any (\"10.\", \"192.168.\", \"172.16.\", \"172.17.\", \"172.18.\", \"172.19.\",\n    \"172.20.\", \"172.21.\", \"172.22.\", \"172.23.\", \"172.24.\", \"172.25.\", \"172.26.\", \"172.27.\",\n    \"172.28.\", \"172.29.\", \"172.30.\", \"172.31.\"))\n| summarize\n    ConnCount = count(),\n    DistinctPorts = dcount(RemotePort),\n    Ports = make_set(RemotePort, 20)\n    by DeviceName, RemoteIP, InitiatingProcessFileName\n| where ConnCount > 5\n| extend KnownBadPort = set_has_element(Ports, KnownBadPorts)\n| extend timestamp = now(), HostCustomEntity = DeviceName, IPCustomEntity = RemoteIP\n| order by KnownBadPort desc, ConnCount desc"
      },
      {
        "name": "1aac7737-d52f-483d-b225-6a27c1b29a9e — Contrast ADR - DLP SQL Injection Correlation",
        "description": "Detects successful SQL injection attacks identified by Contrast ADR and correlates them with WAF/DLP logs. This rule identifies critical database security breaches that have bypassed initial defenses and may result in data exfiltration or unauthorized database access.' (Source: Microsoft's official Azure-Sentinel Detections (MIT licensed).)",
        "query": "ContrastADRAttackEvents_CL\n| where result =~ \"EXPLOITED\" and rule =~ \"SQL-INJECTION\"\n| project-rename hostname = host_hostname\n//please add your DLP logs table in place of ContrastWAFLogs_CL and hostname colomun in place of hostname below and uncomment the queries below\n//| join kind= inner (ContrastWAFLogs_CL | where TimeGenerated >= ago(5m)) on hostname"
      },
      {
        "name": "826f930c-2f25-4508-8e75-a95b809a4e15 — Abnormal Port to Protocol",
        "description": "Identifies communication for well known protocol over a non-standard port based on learning period activity. This can indicate malicious communication (C2) or exfiltration by attackers trying to communicate over known ports (22:SSH, 80:HTTP) but dont use the known protocol headers to match the port number. Configurable Parameters: - Learning period time - learning period for protocol learning in days. Default is set to 7.' (Source: Microsoft's official Azure-Sentinel Detections (MIT licensed).)",
        "query": "let LearningPeriod = 7d;\nlet RunTime = 1h;\nlet StartLearningPeriod = LearningPeriod + RunTime;\nlet DetectionWindowStart = ago(RunTime);\nlet LearningPortToProtocol1 =  (AzureDiagnostics\n| where TimeGenerated between (ago(StartLearningPeriod) .. ago(RunTime))\n| where OperationName == \"AzureFirewallApplicationRuleLog\"\n| extend msg_s= column_ifexists('msg_s',Message)\n| parse msg_s with Protocol \" request from \" SourceIp \":\" SourcePort:int \" to \" Fqdn \":\" DestinationPort:int \".\" *\n| where isnotempty(DestinationPort)\n| summarize LearningTimeCount = count() by LearningTimeDstPort = DestinationPort, LearningTimeProtocol = Protocol, SourceIp, Fqdn);\nlet LearningPortToProtocol2 = (AZFWNetworkRule\n| where TimeGenerated between (ago(StartLearningPeriod) .. ago(RunTime))\n| where isnotempty(DestinationPort)\n| extend Fqdn = DestinationIp\n| summarize LearningTimeCount = count() by LearningTimeDstPort = DestinationPort, LearningTimeProtocol = Protocol, SourceIp, Fqdn);\nlet LearningPortToProtocol3 = (AZFWApplicationRule\n| where TimeGenerated between (ago(StartLearningPeriod) .. ago(RunTime))\n| where isnotempty(DestinationPort)\n| summarize LearningTimeCount = count() by LearningTimeDstPort = DestinationPort, LearningTimeProtocol = Protocol, SourceIp, Fqdn);\nlet AlertTimePortToProtocol1 = (AzureDiagnostics\n| where TimeGenerated between (DetectionWindowStart .. now())\n| where OperationName == \"AzureFirewallApplicationRuleLog\"\n| extend msg_s= column_ifexists('msg_s',Message)\n| parse msg_s with Protocol \" request from \" SourceIp \":\" SourcePort \" to \" Fqdn \":\" DestinationPort:int \".\" *\n| where isnotempty(DestinationPort)\n| summarize AlertTimeCount = count() by AlertTimeDstPort = DestinationPort, AlertTimeProtocol = Protocol);\nlet AlertTimePortToProtocol2 = (AZFWNetworkRule\n| where TimeGenerated between (DetectionWindowStart .. now())\n| where isnotempty(DestinationPort)\n| extend Fqdn = DestinationIp\n| summarize AlertTimeCount = count() by AlertTimeDstPort = DestinationPort, AlertTimeProtocol = Protocol);\nlet AlertTimePortToProtocol3 = (AZFWApplicationRule\n| where TimeGenerated between (DetectionWindowStart .. now())\n| where isnotempty(DestinationPort)\n| summarize AlertTimeCount = count() by AlertTimeDstPort = DestinationPort, AlertTimeProtocol = Protocol);\n(union isfuzzy=true \n(AlertTimePortToProtocol1 \n| join kind=leftouter (LearningPortToProtocol1) on $left.AlertTimeDstPort == $right.LearningTimeDstPort\n| where LearningTimeProtocol != AlertTimeProtocol),\n(AlertTimePortToProtocol2 \n| join kind=leftouter (LearningPortToProtocol2) on $left.AlertTimeDstPort == $right.LearningTimeDstPort\n| where LearningTimeProtocol != AlertTimeProtocol),\n(AlertTimePortToProtocol3 \n| join kind=leftouter (LearningPortToProtocol3) on $left.AlertTimeDstPort == $right.LearningTimeDstPort\n| where LearningTimeProtocol != AlertTimeProtocol))"
      }
    ],
    "spl": [],
    "esql": [
      {
        "name": "e7e0588b-2b55-4f88-afd1-cf98e95e0f58 — Suspicious Outbound Network Connection via Unsigned Binary",
        "description": "(EQL) Detects the execution of an unsigned or untrusted binary followed by an outbound network connection to a raw IP address on a non-standard port. Many malicious payloads will connect directly to C2 or a payload server using non-standard ports. (Source: Elastic's official detection-rules repository (Elastic License v2).)",
        "query": "sequence by process.entity_id with maxspan=1m\n  [process where host.os.type == \"macos\" and event.type == \"start\" and event.action == \"exec\" and \n    (process.code_signature.trusted == false or process.code_signature.exists == false) and\n    process.args_count == 1 and\n    not process.executable like \"/opt/homebrew/*\"]\n  [network where host.os.type == \"macos\" and event.type == \"start\" and \n    destination.domain == null and \n    not destination.port in (443, 80, 53, 22, 25, 587, 993, 465, 8080, 8200, 9200) and \n    destination.port < 49152 and\n    not cidrmatch(destination.ip, \"0.0.0.0\", \"240.0.0.0/4\", \"233.252.0.0/24\", \"224.0.0.0/4\", \n                  \"198.19.0.0/16\", \"192.18.0.0/15\", \"192.0.0.0/24\", \"10.0.0.0/8\", \"127.0.0.0/8\", \n                  \"169.254.0.0/16\", \"172.16.0.0/12\", \"192.0.2.0/24\", \"192.31.196.0/24\", \n                  \"192.52.193.0/24\", \"192.168.0.0/16\", \"192.88.99.0/24\", \"100.64.0.0/10\", \n                  \"192.175.48.0/24\", \"198.18.0.0/15\", \"198.51.100.0/24\", \"203.0.113.0/24\",\n                  \"::1\", \"FE80::/10\", \"FF00::/8\")]"
      },
      {
        "name": "9edd000e-cbd1-4d6a-be72-2197b5625a05 — Suricata and Elastic Defend Network Correlation",
        "description": "(EQL) This detection correlates Suricata alerts with Elastic Defend network events to identify the source process performing the network activity. (Source: Elastic's official detection-rules repository (Elastic License v2).)",
        "query": "sequence by source.port, source.ip, destination.ip with maxspan=5s\n [network where data_stream.dataset == \"suricata.eve\" and event.kind == \"alert\" and\n  event.severity != 3 and source.ip != null and destination.ip != null and\n  not source.domain : (\"*nessusscan*\", \"SCCMPS*\") and\n  not rule.name in (\"ET INFO SMB2 NT Create AndX Request For a Powershell .ps1 File\", \"ET SCAN MS Terminal Server Traffic on Non-standard Port\")]\n [network where event.module == \"endpoint\" and event.action in (\"disconnect_received\", \"connection_attempted\") and\n  not process.executable in (\"System\", \"C:\\\\Program Files (x86)\\\\Admin Arsenal\\\\PDQ Inventory\\\\PDQInventoryService.exe\") and \n  not process.executable : \"C:\\\\Windows\\\\AdminArsenal\\\\PDQInventory-Scanner\\\\service-*\\\\exec\\\\PDQInventoryScanner.exe\"]"
      }
    ]
  },
  "automation": {
    "safe": [
      "Add recommendation as Sentinel incident comment.",
      "Run enrichment queries.",
      "Create ServiceNow SecOps task."
    ],
    "approval_required": [
      "Contain or disable the affected host/account.",
      "Any change to production configuration."
    ]
  },
  "escalation_criteria": [
    "Non-Standard Port activity observed on a privileged account or critical system.",
    "Activity follows or precedes other suspicious behaviour in the same investigation.",
    "Automated triage cannot confidently rule out malicious intent."
  ],
  "false_positive_considerations": [
    "Legitimate administrative or maintenance activity matching this pattern.",
    "Approved security testing or red team exercise.",
    "Known benign software producing similar telemetry."
  ],
  "confluence": {
    "title": "T1571 - Non-Standard Port Response Guidance",
    "labels": [
      "mitre",
      "attack",
      "d3fend",
      "secops",
      "basyrix"
    ],
    "sections": [
      "summary",
      "d3fend_mappings",
      "investigation_steps",
      "response_actions",
      "queries",
      "automation",
      "escalation_criteria",
      "false_positive_considerations"
    ]
  }
}