Techniques › T1205 › AN1448
AN1448 Analytic 1448
Windows · attack.mitre.org · ATT&CK Enterprise v19.2
<p>A remote host sends a short sequence of failed connection attempts (RST/ICMP unreachable) to a set of closed ports. Within a brief window the endpoint (a) adds/enables a firewall rule or (b) a sniffer-backed process begins listening or opens a new socket, after which a successful connection occurs. Also detects Wake-on-LAN magic packets seen on local segment.</p>
- Detects
- T1205 Traffic Signaling
- Part of
- DET0524 Traffic Signaling (Port-knock / magic-packet → firewall or service activation) – T1205
Log sources and channels
Exactly as MITRE states them in x_mitre_log_source_references. Where a channel is vague, it is vague in the source; kevmap does not tidy it.
| Log source | Channel | Data component |
|---|---|---|
| WinEventLog:Sysmon | EventCode=1 | DC0032 Process Creation |
| WinEventLog:Sysmon | EventCode=3, 22 | DC0082 Network Connection Creation |
| WinEventLog:Microsoft-Windows-Windows Firewall With Advanced Security/Firewall | EventCode=2004, 2005, 2006 | DC0078 Network Traffic Flow |
| WinEventLog:PowerShell | EventCode=4103, 4104, 4105, 4106 | DC0064 Command Execution |
Mutable elements
Parameters MITRE marks as environment-specific. These are the knobs you are expected to tune; they are why an analytic is not a rule.
| Field | Description |
|---|---|
TimeWindowKnock | Window to correlate knock sequence → rule change → successful connect (e.g., 120s). |
PortSequenceMinLen | Minimum number of distinct closed ports hit before success (e.g., 3). |
SuspiciousProcesses | List of binaries that commonly toggle firewall/sniff (netsh.exe, powershell.exe, npcapservice.exe, windivert, rawsock tools). |
AllowedFirewallChangers | Service accounts or software update agents allowed to change firewall. |
WoLAllowedWindows | Maintenance windows when magic packets are expected. |