Detecting Non-Standard Port (T1571) C2 with SIEM

What is non-standard port (T1571)?

Non-Standard Port (T1571) describes how adversaries use ports other than the expected port for a given protocol to conduct C2 communications. By running C2 on ports that firewalls allow but do not inspect with protocol-aware rules, attackers can bypass security controls designed around standard port assignments.

Common examples include:

• HTTPS on port 8443 or 4443 - Alternative HTTPS ports that some firewalls allow without deep inspection
• HTTP C2 on port 8080 or 8888 - Web proxy ports that may bypass perimeter controls
• Metasploit default on port 4444 - Meterpreter reverse shell commonly uses this port
• Cobalt Strike on port 50050 - Default team server port (often changed but still detectable)
• Raw TCP C2 on port 53 - Disguised as DNS traffic but not actually using the DNS protocol
• TLS C2 on port 21 - Encrypted C2 on the FTP port, bypassing content inspection

Protocol-port mismatch detection

The strongest detection signal for T1571 is a protocol-port mismatch - where the actual protocol in use does not match the service expected on that port. Firewalls with application identification (App-ID) capabilities generate this data automatically.

Common C2 default ports

While experienced attackers change default ports, many C2 frameworks have well-known default configurations that can be detected:

Log360's 9 prebuilt T1571 detection rules

Real-world examples

Meterpreter reverse TCP on port 4444

The most basic and still frequently observed pattern. After exploitation, a Meterpreter reverse TCP shell connects back to the attacker on port 4444. Firewall logs show raw TCP traffic to an external IP on this well-known post-exploitation port:

Cobalt Strike HTTPS on port 8443

Cobalt Strike operators sometimes configure listeners on port 8443 assuming it will be treated as legitimate alternate HTTPS. While the TLS protocol is correct for this port, the certificate and beaconing pattern reveal C2:

Investigation and response

• Identify the process - Correlate the firewall log source IP and port with endpoint process data. Determine which application is generating the non-standard port connection. Legitimate applications have documented port requirements.
• Check the protocol-port relationship - Use the firewall's App-ID data to confirm whether the actual protocol matches the port. A mismatch strongly indicates C2 or tunneling activity.
• Verify the destination - Query threat intelligence for the destination IP. Check if the port is associated with known C2 frameworks (4444=Metasploit, 50050=Cobalt Strike team server).
• Review connection timing - Examine whether the non-standard port connection shows beaconing patterns. Regular intervals combined with non-standard ports create a high-confidence C2 detection.
• Contain and remediate - Block the destination at the firewall, isolate the compromised host, identify and kill the malicious process, and check for persistence mechanisms.

Remediation and prevention

• Implement default-deny egress - Only allow outbound traffic on explicitly approved ports (80, 443, and specific business needs). This eliminates the majority of non-standard port C2.
• Enable protocol validation - Configure next-gen firewalls to validate that the protocol matches the port (App-ID). Block connections where protocol identification fails or mismatches.
• Monitor allowed non-standard ports - If business applications require non-standard ports (8443, 8080), monitor those ports closely for protocol anomalies and unexpected sources.
• Block known C2 ports - Explicitly deny outbound connections to well-known C2 ports (4444, 4443, 50050, 31337, 1234) at the perimeter firewall.
• Baseline normal port usage - Establish a baseline of normal outbound port patterns per host group. Alert on deviations, especially new ports used by servers or sensitive workstations.

Need to explore ManageEngine Log360? Schedule a personalized demo

FAQ