Testing Usage of Uncommonly Used Port

Title: Testing Usage of Uncommonly Used Port
Status: test
Description:Adversaries may communicate using a protocol and port paring that are typically not associated. For example, HTTPS over port 8088(Citation: Symantec Elfin Mar 2019) or port 587(Citation: Fortinet Agent Tesla April 2018) as opposed to the traditional port 443.
References:
  -https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1571/T1571.md#atomic-test-1---testing-usage-of-uncommonly-used-port-with-powershell
  -https://learn.microsoft.com/en-us/powershell/module/nettcpip/test-netconnection?view=windowsserver2022-ps
Author: frack113
Date: 2022-01-23
modified:None
Tags:

• -'attack.command-and-control'
• -'attack.t1571'

Logsource:

• product: windows
• category: ps_script
• definition: Requirements: Script Block Logging must be enabled

Detection:
  selection:
    ScriptBlockText|contains|all:
      -'Test-NetConnection'
      -'-ComputerName '
      -'-port '

  filter:
    ScriptBlockText|contains:
      -' 443 '
      -' 80 '

  condition:selection and not filter
Falsepositives:
  -Legitimate administrative script
Level: medium