Suspicious C2 port
Flags a network connection to a port strongly associated with offensive C2 frameworks, backdoors, or covert tunnels (Metasploit 4444/4445, common…
What it detects
Flags a network connection to a port strongly associated with offensive C2 frameworks, backdoors, or covert tunnels (Metasploit 4444/4445, common backdoors 1337/12345/31337, IRC C2 6667, Tor 9001/9030/9050). Ranks the connection for review — benign services rarely use these ports, and a hit here alongside the Layer-2 beaconing signal is high-value.
MITRE ATT&CK mapping
False positives and triage
Some development, chat, or privacy tools use these ports occasionally. Confidence rises when the destination is external, the initiating process is unusual (rundll32, powershell, a temp-path binary), or the connection is periodic. Correlate with the network anomaly ranking and the process that opened the socket.
The rule
Declarative YAML read by the detection engine — data, never executed. Confidence 50%. Source: rules/multi/suspicious_c2_port.yaml, licensed under the Apache License 2.0.
id: network.suspicious_c2_port
version: 1.0.0
status: experimental
severity: medium
confidence: 0.5
platforms: [windows, linux, macos]
mitre_techniques: [T1571, T1090]
description: |
Flags a network connection to a port strongly associated with offensive C2 frameworks,
backdoors, or covert tunnels (Metasploit 4444/4445, common backdoors 1337/12345/31337,
IRC C2 6667, Tor 9001/9030/9050). Ranks the connection for review — benign services rarely
use these ports, and a hit here alongside the Layer-2 beaconing signal is high-value.
match:
event_category: network
destination_port_any:
["4444", "4445", "1337", "12345", "31337", "6667", "9001", "9030", "9050", "54321"]
false_positive_guidance: |
Some development, chat, or privacy tools use these ports occasionally. Confidence rises
when the destination is external, the initiating process is unusual (rundll32, powershell,
a temp-path binary), or the connection is periodic. Correlate with the network anomaly
ranking and the process that opened the socket.
Related detections
Run this rule on your own logs — offline
KIROSEC runs this rule and the rest of the library over Windows, Linux, macOS and cloud audit logs on the analyst's own machine. Every alert links to the events that raised it, and nothing leaves the device.