Techniques › T1571 › AN0633
AN0633 Analytic 0633
Windows · attack.mitre.org · ATT&CK Enterprise v19.2
<p>Processes initiating outbound connections on uncommon ports or using protocols inconsistent with the assigned port. Correlating process creation with subsequent network connections reveals anomalies such as svchost.exe or Office applications using high, atypical ports.</p>
- Detects
- T1571 Non-Standard Port
- Part of
- DET0227 Detection Strategy for Non-Standard Ports
Log sources and channels
Exactly as MITRE states them in x_mitre_log_source_references. Where a channel is vague, it is vague in the source; kevmap does not tidy it.
| Log source | Channel | Data component |
|---|---|---|
| WinEventLog:Security | EventCode=5156, 5157 | DC0082 Network Connection Creation |
| WinEventLog:Sysmon | EventCode=1 | DC0032 Process Creation |
Mutable elements
Parameters MITRE marks as environment-specific. These are the knobs you are expected to tune; they are why an analytic is not a rule.
| Field | Description |
|---|---|
PortThresholds | Define what constitutes a 'non-standard port' based on organizational baselines (e.g., allow 443/80/22 but flag 8088/587/3389 changes). |
ProcessAllowList | Processes normally allowed to use non-standard ports (e.g., custom apps). |
TimeWindow | Correlate process creation and network activity within N seconds. |
KEV CVEs whose mapped technique this analytic detects
| CVE | Vendor / product | State |
|---|---|---|
| CVE-2023-38035 | Ivanti Sentry | Mapped |