Techniques › T1205.001 › AN0842
AN0842 Analytic 0842
Windows · attack.mitre.org · ATT&CK Enterprise v19.2
<p>A remote source rapidly touches a short sequence of closed ports (SYN→RST/S0) on a Windows host. Within a short window the host changes firewall state (WFP rule added/modified or service starts listening) and then the same source completes the first successful handshake to the newly opened port.</p>
- Detects
- T1205.001 Port Knocking
- Part of
- DET0302 Port-knock → rule/daemon change → first successful connect (T1205.001)
Log sources and channels
Exactly as MITRE states them in x_mitre_log_source_references. Where a channel is vague, it is vague in the source; kevmap does not tidy it.
| Log source | Channel | Data component |
|---|---|---|
| WinEventLog:Sysmon | EventCode=1 | DC0032 Process Creation |
| WinEventLog:Sysmon | EventCode=3, 22 | DC0082 Network Connection Creation |
| WinEventLog:Microsoft-Windows-Windows Firewall With Advanced Security/Firewall | EventCode=2004, 2005, 2006 | DC0078 Network Traffic Flow |
Mutable elements
Parameters MITRE marks as environment-specific. These are the knobs you are expected to tune; they are why an analytic is not a rule.
| Field | Description |
|---|---|
TimeWindow | Seconds to correlate knock sequence → rule change → successful connect (60–300s typical). |
MinSequenceLen | Minimum number of distinct destination ports in the sequence (≥3 by default). |
RuleChangeAllowList | Accounts/processes allowed to adjust Windows Firewall (e.g., update agents). |
WatchedPorts | Ports of interest to flag when opened (e.g., 22,23,2323,8022,3389,8080). |