Traffic Signaling (Port-knock / magic-packet → firewall or service activation) – T1205, Detection Strategy DET0524
Excerpt
AN1448
A remote host sends a short sequence of failed connection attempts (RST/ICMP unreachable) to a set of closed ports. Within a brief window the endpoint (a) adds/enables a firewall rule or (b) a sniffer-backed process begins listening or opens a new socket, after which a successful connection occurs. Also detects Wake-on-LAN magic packets seen on local segment.
Log Sources
Data Component Name Channel
Process Creation
(DC0032)
WinEventLog:Sysmon EventCode=1
Network Connection
Creation (DC0082)
WinEventLog:Sysmon EventCode=3, 22
Network Traffic Flow
(DC0078)
WinEventLog:Microsoft-Windows-Windows
Firewall With Advanced Sec…
The opening of the report, shown for reference. The full report, with its figures and indicators, is published by MITRE ATT&CK on attack.mitre.org.
More from MITRE ATT&CK43
- techdoc_lite-deliverables-numbered option.dotxMITRE ATT&CK · Added 16 Jun
- Cross-Platform Detection of Data Transfer to Cloud Account, Detection Strategy DET0573MITRE ATT&CK · Added 6 Apr
- Encrypted Channel, Technique T1573 - EnterpriseMITRE ATT&CK · Added 6 Apr
- Boot or Logon Autostart Execution: Time Providers, Sub-technique T1547.003 - EnterpriseMITRE ATT&CK · Added 6 Apr
