T1205.001No distinct observable

Port Knocking

Stealth · Persistence · Command and ControlLinux, macOS, Network Devices, Windows

Where this stands

A reviewer read the telemetry and concluded there is nothing here to detect that a sibling technique does not already cover.

Port knocking is defined by an ordered temporal correlation across three separate events from three separate feeds — a short run of connection attempts to distinct closed ports from one source, then a firewall or daemon state change on the host, then the first successful connect from that same source — and every analytic in DET0302 says exactly that. Every mutable element MITRE gives is a parameter of that correlation and nothing else: TimeWindow and MinSequenceLen on AN0842, KnockTolerance and ServicePort on AN0843. lib/sigma models no aggregation, no timeframe and no join across log sources, so the sequence, the count and the same-source requirement — the only properties that make a knock a knock rather than three unrelated events — cannot be stated at all. Worse, the knock itself is not carried by any log source in this brief. […]

Covered instead by T1205.002, T1040.

What the technique is

Adversaries may use port knocking to hide open ports used for persistence or command and control. To enable a port, an adversary sends a series of attempted connections to a predefined sequence of closed ports. After the sequence is completed, opening a port is often accomplished by the host based firewall, but could also be implemented by custom software. This technique has been observed both for the dynamic opening of a listening port as well as the initiating of a connection to a listening server on a different system. The observation of the signal packets to trigger the communication can be conducted through different methods. One means, originally implemented by Cd00r, is to use the libpcap libraries to sniff for the packets in question. Another method leverages raw sockets, which enables the malware to use ports that are already open for use by other programs.

Read it on attack.mitre.org

What MITRE says you would watch

AN0842
A remote source rapidly touches a short sequence of closed ports (SYN→RST/S0) on a Windows host. Within a short window the host changes firewall state (WFP rule added/modified or service starts listening) and then the same source completes the first successful handshake to the newly opened port.
AN0843
A source performs a short closed-port sequence; the host then modifies iptables/nftables/ufw rules or starts a daemon binding a new socket, followed by a successful connection from the same source.
AN0844
A source performs a closed-port sequence; the endpoint enables a PF/socketfilterfw rule or a background process binds a port; then a successful connection completes from the same source.