Outbound Connection to a Known C2-Associated Port

Detects an allowed outbound connection to a destination port commonly associated with command-and-control frameworks and reverse shells (e.g. Metasploit's and Cobalt Strike's default handler ports) rather than a standard application port.

T1571

Detection logic

{
  "detection_type": "selection",
  "selection": {
    "action": "allow",
    "zone_dst": "untrust",
    "dst_port": [
      4444,
      1337,
      31337
    ]
  }
}

Log source: category=firewall · Event ID(s): fw_allow

Required log fields

action
zone_dst
dst_port

Enabling this in your environment

Where: Firewall traffic logging - allowed sessions

Enable allow-session logging so outbound connections on non-standard ports are visible, not just denies.

Cheap to bypass by simply picking a different port - pair this with FW-7002 (volume) and FW-7004 (retry pattern) rather than relying on it alone.

False positives

Internal tooling or an authorized penetration test reusing the same default ports
A custom internal application that happens to use one of these ports

References

https://attack.mitre.org/techniques/T1571/