Non-standard port usage is a foundational indicator of C2 activity. Metasploit defaults to port 4444, IRC-based botnets use 6667, and hacktivist/script kiddie tooling historically uses 31337 ("elite") and 1337. More sophisticated malware uses ephemeral high ports with regular beacon intervals to blend with legitimate HTTPS traffic.
This SOP covers two detection paths: known malicious port signature detection (immediate escalation) and beacon interval analysis to catch C2 traffic that uses high ports with regular jitter patterns.
☰ Table of Contents
01 — BACKGROUND
TECHNIQUE OVERVIEWAttackers use non-standard ports to avoid signature-based firewall rules that monitor only well-known ports. T1571 (Non-Standard Port) covers any protocol tunnelled over an unexpected port (e.g., C2 traffic on TCP 4444). T1095 (Non-Application Layer Protocol) covers raw TCP/UDP sockets used directly for C2 without HTTP/HTTPS wrapping. Beacon interval regularity — connections at fixed intervals (± random jitter) — is the key behavioral discriminator between C2 and legitimate application traffic.
| Field | Value |
|---|---|
| MITRE Technique | T1571 — Non-Standard Port |
| Sub-technique | T1095 — Non-Application Layer Protocol |
| Log Sources | ASimNetworkSession, DeviceNetworkEvents, CommonSecurityLog |
| High-Risk Ports | 4444 (Metasploit/Meterpreter), 6667 (IRC botnet), 31337 (legacy RAT), 1337, 8888, 9999, 65535 |
| Detection Method | Port signature match + beacon interval analysis (regular connection intervals) |
| Detection Priority | HIGH — port 4444/31337 is near-certain malware; other ports require context |
Some legitimate developer tools (NetBeans, IntelliJ debuggers, custom application test ports) use ports 4444 or 8888. Always check the initiating process before escalating — an IDE debug process on port 4444 is a false positive; a system process (svchost.exe, explorer.exe) on port 4444 is not.
02 — IDENTIFICATION
2 INDICATORSPorts 4444, 31337, and 6667 have no legitimate corporate use cases. Any outbound connection on these ports from a non-developer workstation is near-certain malware or attacker tooling. The initiating process name is the key discriminator between malware and developer tool false positives.
- 1Navigate to Microsoft Sentinel → Logs. Set time range to Last 24 hours.
- 2Paste the KQL below. Focus on
SrcIpAddr(internal host) andDstPortNumber. - 3Cross-reference the alert with Defender for Endpoint → Device → Timeline for the affected host to identify the initiating process.
- 4If the initiating process is a system binary (
svchost.exe,lsass.exe,powershell.exe,cmd.exe,regsvr32.exe) or an unknown process from%TEMP%or%APPDATA%— escalate immediately. - 5If the process is a known IDE (
idea64.exe,devenv.exe) and the user is a developer — flag as false positive, tune the detection rule to exclude that host/user.
| Port | Known Association | Action |
|---|---|---|
| 4444 TCP | Metasploit Meterpreter default — near-certain active exploitation | ESCALATE NOW |
| 31337 TCP | Legacy RAT / Back Orifice / "elite" tool default | ESCALATE NOW |
| 6667 TCP | IRC botnet C2 — may indicate older bot infection | ESCALATE |
| 1337 TCP | Script kiddie / custom RAT port — context-dependent | INVESTIGATE |
| 8888 TCP | Jupyter Notebook default (developer FP) OR custom malware port | INVESTIGATE |
Port 8888 is used by Jupyter Notebook, Cobalt Strike team server, and various web frameworks. Never treat a port in isolation — always check the initiating process and whether the destination is internal or external.
Modern C2 frameworks (Cobalt Strike, Sliver, Havoc) avoid known bad ports and instead use high ephemeral ports (above 49000) with regular beacon intervals. The beacon cadence — connections every 30, 60, or 120 seconds with small jitter — is statistically abnormal for legitimate application traffic and can be detected by measuring inter-connection time deltas.
- 1Navigate to security.microsoft.com → Hunting → Advanced Hunting.
- 2Paste the KQL below. Look for
AvgTimeDeltavalues under 120 seconds withBeaconCountabove 10 — this indicates automated beacon activity. - 3Review
InitiatingProcessFileNamein the Device Timeline for each flagged host to identify the process generating the beacon. - 4Check if the destination IP changed across connections (rotating C2) or stayed constant (single C2 server) — rotating infrastructure indicates a more sophisticated operator.
- 5If beacon is confirmed, treat as active C2 — do not block the connection until forensic capture is complete (network packet dump via Live Response if possible).
If a beacon is confirmed, capture a PCAP via Live Response before isolating the host — the payload data can identify the C2 framework (Cobalt Strike Malleable profile, Sliver, Havoc) which is critical for malware attribution and determining if credentials were exfiltrated over the C2 channel.
03 — CONTAINMENT
IMMEDIATE ACTIONConfirmed port 4444 activity from any non-developer, non-IT system process must be treated as active Meterpreter/C2 session. Escalate as SEV1 immediately and assume the attacker has interactive shell access to the host.
- 1Initiate network isolation on the affected host: Devices → [Device name] → Actions → Isolate device. This severs all network connections while preserving Defender telemetry.
- 2Block the destination IP at the Azure Firewall or perimeter device: Azure Firewall → Rules → Add deny rule for destination IP.
- 3Block outbound TCP on ports 4444, 31337, 6667, 1337 across all internal subnets — these ports have no legitimate corporate use.
- 4Check if any other hosts have connected to the same destination IP (lateral spread indicator) using the KQL from I1 modified to filter on the specific destination IP.
- 5Preserve the process memory of the C2 binary if the host is still live — use Live Response to run a memory dump before isolation if timing allows.
04 — ERADICATION
CLEANUP- 1Kill the C2 process via Live Response: Device → Actions → Initiate Live Response → run
run get-processes.ps1to list processes, then terminate the malicious process by PID. - 2Delete the malware binary and any associated scheduled tasks or registry persistence entries identified in the device timeline.
- 3Run a full Defender AV scan on the host: Device → Actions → Run antivirus scan.
- 4Add the C2 destination IP to the Sentinel ThreatIntelligenceIndicator watchlist to alert on any other internal hosts connecting to the same IP.
- 5Block outbound TCP ports 4444, 31337, 6667, 1337 permanently at the perimeter firewall — confirm no business application requires these ports before hardening.
- 6Review lateral movement indicators: check if the attacker pivoted from the compromised host using SMB (port 445), WMI (port 135), or RDP (port 3389) to adjacent systems.
- No ASimNetworkSession events on C2 ports from affected host in past 2 hours
- Malware binary removed and AV scan returned clean
- C2 destination IP blocked at perimeter and added to threat intel watchlist
- Registry persistence and scheduled task persistence entries cleared
- No lateral movement detected to adjacent hosts
05 — ESCALATION
ESCALATION PATHS| Condition | Severity | Action | Notify |
|---|---|---|---|
| Active Meterpreter shell (port 4444) | SEV1 | Isolate immediately, full IR, forensic hold | SOC Lead → CISO → IR Team |
| Beacon from privileged host (DC/server) | SEV1 | Treat as domain compromise, IR escalation | SOC Lead → CISO → Infra Team |
| Beacon from workstation, no pivot detected | SEV2 | Isolate, eradicate, check for data staging | SOC Lead → Security Manager |
| Port 1337/8888 from unknown process | SEV3 | Investigate process, sandbox binary, monitor | SOC Lead |
| Developer IDE / authorized tool | INFO | Tune detection exception, document, close | None |
When escalating port 4444 activity, always assume the attacker has had interactive access to the host from the first connection timestamp. Calculate the dwell time (first connection to detection) and use that window to scope what data may have been exfiltrated — this drives the breach notification decision.
Stay Threat-Ready
Follow CyberHawk Threat Intel for daily SOC analyst playbooks, detection engineering guides, and threat intelligence.