Port Knocking (MITRE ATT&CK T1205.001) is a sub-technique of traffic signaling. The adversary hides open ports used for persistence or command and control. MITRE files it under Stealth, Persistence and Command and Control, and lists Linux, Network Devices, Windows and macOS.
How attackers use it
To enable a port, the adversary sends a series of connection attempts to a predefined sequence of closed ports. When the sequence is complete, the host firewall often opens the port, though custom software can do it too. MITRE says the technique has been seen both for dynamically opening a listening port and for starting a connection to a listening server on another system.
The signal can be observed in two ways. One, originally implemented by a tool called cd00r, uses libpcap to sniff for the packets. The other uses raw sockets, which lets malware use ports that are already open for other programs. The MITRE page says the original cd00r code watched for a single SYN packet sent in series to a configurable set of ports before opening a port.
How to detect it
MITRE's detection strategy is: knock, then a rule or daemon change, then the first successful connection.
- Windows. A remote source quickly touches a short sequence of closed ports (SYN then RST). Within a short window the host changes firewall state (a Windows Filtering Platform rule is added or modified, or a service starts listening), and the same source completes its first successful handshake on the newly opened port.
- Linux. The same sequence, then iptables, nftables or ufw rules change, or a daemon binds a new socket, followed by a successful connection from that source.
- macOS. A closed-port sequence, then a PF or socketfilterfw rule is enabled or a background process binds a port.
- Network devices. A knock pattern against the device unicast, broadcast and network addresses on the same or stepped ports, followed by ACL or line vty service enablement and the first management session.
Firewall logs of denied connections from one source, host firewall change logs and listener inventories are the data to collect.
How to reduce the risk
MITRE says stateful firewalls can mitigate some variants, depending on how the technique is implemented. Alert on firewall rule changes on servers and on new listening sockets, and keep a baseline of expected listeners.
Quick check
What order of events suggests port knocking?
A burst of failed connections to closed ports from one source, then a firewall rule change or a new listener, then a successful connection from the same source.
