Commonly Used Port T0885

ICS Tactic: Command and Control

Authoring guide

These 1 rule share fields, values, and exclusions.

Fields filtered most (3 distinct)

These fields appear most often in rule filters.

FieldRulesHowSample values
from1eq 1null
passwordProtected1eq 1false
sanitizationResult1contains 1blocked

Top indicator values (3 distinct)

These values appear most often in rule predicates.

FieldKindValueRules (here)Corpus reach
fromeq
null
12
passwordProtectedeq
false
12
sanitizationResultcontains
blocked
12

Rules under this technique

These vendors publish rules tagged with this technique.

Platform: Network

Domain: Network

Kusto 1 rule