Testing Usage of Uncommonly Used Port

SigmaHQ Detections@sigmaHQ

•updated Sep 1, 2026•2•0•5

Adversaries may communicate using a protocol and port paring that are typically not associated. For example, HTTPS over port 8088(Citation: Symantec Elfin Mar 2019) or port 587(Citation: Fortinet Agent Tesla April 2018) as opposed to the traditional port 443.