Techniques › T1205.001 › AN0844
AN0844 Analytic 0844
macOS · attack.mitre.org · ATT&CK Enterprise v19.2
<p>A source performs a closed-port sequence; the endpoint enables a PF/socketfilterfw rule or a background process binds a port; then a successful connection completes from the same source.</p>
- Detects
- T1205.001 Port Knocking
- Part of
- DET0302 Port-knock → rule/daemon change → first successful connect (T1205.001)
Log sources and channels
Exactly as MITRE states them in x_mitre_log_source_references. Where a channel is vague, it is vague in the source; kevmap does not tidy it.
| Log source | Channel | Data component |
|---|---|---|
| macos:unifiedlog | exec: Execution of pfctl, socketfilterfw, launchctl start ssh/telnet, libpcap consumers. | DC0032 Process Creation |
| macos:unifiedlog | Firewall/PF anchor load or rule change events. | DC0078 Network Traffic Flow |
| NSM:Flow | Sequence of REJ/S0 then SF success from same src_ip within TimeWindow. | DC0082 Network Connection Creation |
Mutable elements
Parameters MITRE marks as environment-specific. These are the knobs you are expected to tune; they are why an analytic is not a rule.
| Field | Description |
|---|---|
PFAnchorPaths | Anchors/confs to monitor (/etc/pf.conf, /etc/pf.anchors/*). |
DevMode | Suppress expected PF testing on developer devices. |