Port Knocking

ATT&CK T1205.001

Adversaries may use port knocking to hide open ports used for persistence or command and control. To enable a port, an adversary sends a series of attempted connections to a predefined sequence of closed ports. After the sequence is completed, opening a port is often accomplished by the host based firewall, but could also be implemented by custom software. This technique has been observed both for the dynamic opening of a listening port as well as the initiating of a connection to a listening server on a different system. The observation of the signal packets to trigger the communication can b

Category: Technique, stealth, persistence, command-and-control

MITRE ATT&CK: T1205.001

Reference: MITRE ATT&CK T1205.001