Find sigma rule 
Attack: Non-Standard Port
Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088(Citation: Symantec Elfin Mar 2019) or port 587(Citation: Fortinet Agent Tesla April 2018) as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Adversaries may also make changes to victim systems to abuse non-standard ports. For example, Registry keys and other configuration settings can be used to modify protocol and port pairings.(Citation: change_rdp_port_conti)
MITRE
Tactic
- command-and-control
technique
- T1571
Test : Testing usage of uncommonly used port with PowerShell
OS
- windows
Description:
Testing uncommonly used port utilizing PowerShell. APT33 has been known to attempt telnet over port 8081. Upon execution, details about the successful port check will be displayed.
Executor
powershell
Sigma Rule
- posh_ps_test_netconnection.yml (id: adf876b3-f1f8-4aa9-a4e4-a64106feec06)