Live Active security incident? Get immediate response
MITRE ATT&CK® Technique

T1205: Traffic Signaling

Adversaries may use traffic signaling to hide open ports or other malicious functionality used for persistence or command and control. Traffic signaling involves the use of a magic value or sequence that must be sent to a system to trigger a special response, such as opening a closed port or executing a malicious task. This may take the form of sending a series of packets with certain characteristics before a port will be opened that the adversary can use for command and control. Usually this series of packets consists of attempted connections to a predefined sequence of closed ports (i.e. Port Knocking), but can involve unusual flags, specific strings, or other unique characteristics. After the sequence is completed, opening a port may be accomplished by the host-based firewall, but could also be implemented by custom software.

Adversaries may also communicate with an already open port, but the service listening on that port will only respond to commands or trigger other malicious functionality if passed the appropriate magic value(s).

The observation of the signal packets to trigger the communication can be conducted through different methods. One means, originally implemented by Cd00r [1], is to use the libpcap libraries to sniff for the packets in question. Another method leverages raw sockets, which enables the malware to use ports that are already open for use by other programs.

On network devices, adversaries may use crafted packets to enable Network Device Authentication for standard services offered by the device such as telnet. Such signaling may also be used to open a closed service port such as telnet, or to trigger module modification of malware implants on the device, adding, removing, or changing malicious capabilities. Adversaries may use crafted packets to attempt to connect to one or more (open or closed) ports, but may also attempt to connect to a router interface, broadcast, and network address IP on the same port in order to achieve their goals and objectives.[2][3][4] To enable this traffic signaling on embedded devices, adversaries must first achieve and leverage Patch System Image due to the monolithic nature of the architecture.

Adversaries may also use the Wake-on-LAN feature to turn on powered off systems. Wake-on-LAN is a hardware feature that allows a powered down system to be powered on, or woken up, by sending a magic packet to it. Once the system is powered on, it may become a target for lateral movement.[5][6]

EnterpriseT1205TechniqueObject v3.0 Modified
Discuss defensive coverage Back to ATT&CK
Glexia's Take

Analyst context for executives and security teams

Analyst confidence High

Traffic Signaling matters because it can make a backdoor or command channel appear absent until a specific network “signal” is received. For executives and security leaders, the risk is not just an open port; it is hidden persistence on endpoints or network devices that may evade routine service discovery, firewall reviews, and vulnerability scans. The technique is especially material for environments with Linux, macOS, Windows, and network devices where adversaries can hide access behind port knocking, socket filters, crafted packets, or Wake-on-LAN behavior.

Executive priority

Prioritize this as a resilience and assurance issue for externally reachable systems, internal administration paths, and critical network devices. Leaders should ask whether firewall rules, network segmentation, device hardening, and monitoring can prove that unexpected ports, crafted packet sequences, or Wake-on-LAN traffic would be noticed. The ATT&CK relationships show this behavior is associated with multiple malware families, campaigns, and groups, including network-device-focused activity, so coverage should be validated as part of incident response readiness, edge-device security reviews, and compliance evidence for network control enforcement.

Technical view

For SOC, detection engineering, and IR teams, validate coverage across Linux, macOS, Windows, and network devices for stealth, persistence, and command-and-control behaviors. Because MITRE does not provide official detection text for T1205, detection should be built from the described behavior and the related detection strategy DET0524: look for port-knock or magic-packet patterns that precede firewall or service activation, unusual packets to open or closed ports, unexpected responses only after specific values, and crafted traffic to router interfaces, broadcast addresses, or network addresses. IR teams should include network device integrity review where Traffic Signaling is suspected, since the ATT&CK description notes that embedded network devices may require prior system image modification for this capability.

Likely telemetry

  • Firewall allow/deny logs showing repeated connection attempts to closed ports or changes in reachable services
  • Network flow records and packet metadata showing unusual sequences, flags, strings, or crafted packets
  • Endpoint firewall state changes and service-listening changes before and after suspicious traffic
  • Packet capture or network sensor data where available, especially around edge devices and critical segments
  • Network device logs, configuration snapshots, and image-integrity evidence

Detection direction

  • Validate whether scanning and monitoring can detect behavior that is intentionally quiet until a trigger is received; simple open-port discovery may miss it.
  • Tune for sequences of failed or closed-port connection attempts followed by a newly reachable service, outbound callback, or service response.
  • For network devices, include crafted traffic to interfaces, broadcast addresses, and network addresses, not only normal host-to-service flows.
  • Correlate network signals with endpoint or device changes such as firewall rule changes, new listeners, modified services, or altered device images.
  • Account for false positives from legitimate port-knocking tools, network testing, device management, and Wake-on-LAN administration by baselining approved use.

Mitigation priorities

  • Apply M1037 Filter Network Traffic first: restrict ingress, egress, and lateral traffic with explicit firewall and segmentation rules, especially for public-facing systems and management paths.
  • Apply M1042 Disable or Remove Feature or Program: remove unnecessary services, legacy software, and unused features that could be abused as hidden activation points.
  • Review and restrict Wake-on-LAN where it is not operationally required, and monitor it where it must remain enabled.
  • Harden and monitor network devices, including configuration control and image-integrity validation, because ATT&CK notes network-device signaling may depend on modified system images.
  • Document approved port-knocking, remote administration, and device-management patterns so SOC teams can distinguish authorized behavior from suspicious signaling.
Analyst notes and limits

The supplied object has no official MITRE detection text, so practical detection must be inferred from the official description and the DET0524 relationship. The most important decision point is whether the organization can observe both sides of the behavior: the trigger traffic and the resulting service, firewall, or backdoor activation. Relationship context includes Port Knocking, Socket Filters, multiple software examples, and campaigns/groups, but those relationships should be used for prioritization and threat-informed testing rather than assumptions of local exposure.

This take uses only the supplied ATT&CK fields, references, and relationships. It does not assert active exploitation, confirmed attribution, customer exposure, or existing detection coverage. Local architecture, approved remote-access practices, device inventory, firewall logging quality, and packet visibility are required to determine actual risk and coverage.

Official MITRE ATT&CK definition

Traffic Signaling

Adversaries may use traffic signaling to hide open ports or other malicious functionality used for persistence or command and control. Traffic signaling involves the use of a magic value or sequence that must be sent to a system to trigger a special response, such as opening a closed port or executing a malicious task. This may take the form of sending a series of packets with certain characteristics before a port will be opened that the adversary can use for command and control. Usually this series of packets consists of attempted connections to a predefined sequence of closed ports (i.e. Port Knocking), but can involve unusual flags, specific strings, or other unique characteristics. After the sequence is completed, opening a port may be accomplished by the host-based firewall, but could also be implemented by custom software.

Adversaries may also communicate with an already open port, but the service listening on that port will only respond to commands or trigger other malicious functionality if passed the appropriate magic value(s).

The observation of the signal packets to trigger the communication can be conducted through different methods. One means, originally implemented by Cd00r [1], is to use the libpcap libraries to sniff for the packets in question. Another method leverages raw sockets, which enables the malware to use ports that are already open for use by other programs.

On network devices, adversaries may use crafted packets to enable Network Device Authentication for standard services offered by the device such as telnet. Such signaling may also be used to open a closed service port such as telnet, or to trigger module modification of malware implants on the device, adding, removing, or changing malicious capabilities. Adversaries may use crafted packets to attempt to connect to one or more (open or closed) ports, but may also attempt to connect to a router interface, broadcast, and network address IP on the same port in order to achieve their goals and objectives.[2][3][4] To enable this traffic signaling on embedded devices, adversaries must first achieve and leverage Patch System Image due to the monolithic nature of the architecture.

Adversaries may also use the Wake-on-LAN feature to turn on powered off systems. Wake-on-LAN is a hardware feature that allows a powered down system to be powered on, or woken up, by sending a magic packet to it. Once the system is powered on, it may become a target for lateral movement.[5][6]

View the same entry on attack.mitre.org (MITRE-hosted reference; in-page links above use the Glexia ATT&CK library.)

Glexia analysis

How security teams should use this page

Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.

ATT&CK relationship table

Related techniques

This mirrors the MITRE pattern of making group, software, campaign, and technique relationships scannable. Relationship notes come from mirrored ATT&CK relationship text when available.

2 rows
Domain ID Name Relationship / procedure
Enterprise T1205.001 Port Knocking Sub-technique Port Knocking subtechnique of this object.
Enterprise T1205.002 Socket Filters Sub-technique Socket Filters subtechnique of this object.
Associated objects

Groups, software, and campaigns

Group Enterprise

G1048: UNC3886

UNC3886 is a China-nexus cyberespionage group that has been active since at least 2022, targeting defense, technology, and telecommunication organizations located in the United States and the Asia-Pacific-Japan (APJ) regions. UNC3886 has displayed a deep understanding of edge devices and virtualization technologies through the exploitation of zero-day vulnerabilities and the use of novel malware families and utilities.[1][2]

Group Enterprise

G0129: Mustang Panda

Mustang Panda is a China-based cyber espionage threat actor that has been conducting operations since at least 2012. Mustang Panda has been known to use tailored phishing lures and decoy documents to deliver malicious payloads. Mustang Panda has targeted government, diplomatic, and non-governmental organizations, including think tanks, religious institutions, and research entities, across the United States, Europe, and Asia, with notable activity in Russia, Mongolia, Myanmar, Pakistan, and Vietnam. [1][2][3][4][5][6][7][8][9][10][11][12][13]

Group Enterprise

G0094: Kimsuky

Kimsuky is a Democratic People's Republic of Korea (DPRK)-based cyber espionage group that has been active since at least 2012. The group initially targeted South Korean government agencies, think tanks, and subject-matter experts in various fields. Its operations expanded to include the United Nations and organizations in the government, education, business services, and manufacturing sectors across the United States, Japan, Russia, and Europe. Kimsuky has focused collection on foreign policy and national security issues tied to the Korean Peninsula, nuclear policy, and sanctions. Kimsuky operations have overlapped with those of other North Korean state-sponsored cyber espionage actors as a result of ad hoc collaborations or other limited resource sharing.[1][2][3][4][5][6]

Kimsuky was assessed to be responsible for the 2014 Korea Hydro & Nuclear Power Co. compromise; other notable campaigns include Operation STOLEN PENCIL (2018), Operation Kabar Cobra (2019), and Operation Smoke Screen (2019).[7][8][9] In 2023, Kimsuky was observed using commercial large language models (LLMs) to assist with vulnerability research, scripting, social engineering and reconnaissance.[10]

DPRK threat actor cluster boundaries overlap in open source reporting, with some security researchers consolidating all attributed North Korean state-sponsored cyber activity under Lazarus Group, rather than tracking operationally distinct subgroups.

Malware Enterprise

S0519: SYNful Knock

SYNful Knock is a stealthy modification of the operating system of network devices that can be used to maintain persistence within a victim's network and provide new capabilities to the adversary.[1][2]

Network Devices
Malware Enterprise

S0220: Chaos

Chaos is Linux malware that compromises systems by brute force attacks against SSH services. Once installed, it provides a reverse shell to its controllers, triggered by unsolicited packets. [1]

Linux
Malware Enterprise

S0221: Umbreon

A Linux rootkit that provides backdoor access and hides from defenders.

Linux
Malware Enterprise

S0641: Kobalos

Kobalos is a multi-platform backdoor that can be used against Linux, FreeBSD, and Solaris. Kobalos has been deployed against high profile targets, including high-performance computers, academic servers, an endpoint security vendor, and a large internet service provider; it has been found in Europe, North America, and Asia. Kobalos was first identified in late 2019.[1][2]

Linux
Malware Enterprise

S0446: Ryuk

Ryuk is a ransomware designed to target enterprise environments that has been used in attacks since at least 2018. Ryuk shares code similarities with Hermes ransomware.[1][2][3]

Windows
Malware Enterprise

S1219: REPTILE

REPTILE is an open-source Linux rootkit with multiple components that provides backdoor access and functionality.[1]

Linux
Malware Enterprise

S1203: J-magic

J-magic is a custom variant of the cd00r backdoor tailored to target Juniper routers that was first observed during the J-magic Campaign in mid-2023. J-magic monitors TCP traffic for five predefined parameters or "magic packets" to be sent by the attackers before activating on compromised devices.[1]

Network Devices
Campaign Enterprise

C0029: Cutting Edge

Cutting Edge was a campaign conducted by suspected China-nexus espionage actors, variously identified as UNC5221/UTA0178 and UNC5325, that began as early as December 2023 with the exploitation of zero-day vulnerabilities in Ivanti Connect Secure (previously Pulse Secure) VPN appliances. Cutting Edge targeted the U.S. defense industrial base and multiple sectors globally including telecommunications, financial, aerospace, and technology. Cutting Edge featured the use of defense evasion and living-off-the-land (LoTL) techniques along with the deployment of web shells and other custom malware.[1][2][3][4][5]

Campaign Enterprise

C0056: RedPenguin

The RedPenguin project was launched by Juniper in July 2024 to investigate reported malware infections of Juniper MX Series routers. RedPenguin activity was separately attributed to UNC3886 and included the deployment of multiple custom versions of the publicly-available TINYSHELL backdoor on Juniper routers.[1][2]

Relationship explorer

All related ATT&CK context

uses · Campaign C0029: Cutting Edge Enterprise uses · Malware S1114: ZIPLINE Enterprise uses · Malware S1118: BUSHWALK Enterprise mitigates · Mitigation M1037: Filter Network Traffic Enterprise uses · Malware S0587: Penquin Enterprise uses · Malware S0519: SYNful Knock Enterprise subtechnique of · Technique T1205.001: Port Knocking Enterprise uses · Malware S0430: Winnti for Linux Enterprise uses · Malware S0220: Chaos Enterprise uses · Malware S0221: Umbreon Enterprise uses · Malware S0641: Kobalos Enterprise uses · Malware S0664: Pandora Enterprise uses · Malware S0446: Ryuk Enterprise uses · Malware S1219: REPTILE Enterprise subtechnique of · Technique T1205.002: Socket Filters Enterprise detects · Detection Strategy DET0524: Traffic Signaling (Port-knock / magic-packet → firewall or service activation) – T1205 Enterprise uses · Malware S1203: J-magic Enterprise uses · Malware S9011: BRUSHFIRE Enterprise mitigates · Mitigation M1042: Disable or Remove Feature or Program Enterprise uses · Malware S1228: PUBLOAD Enterprise uses · Malware S1201: TRANSLATEXT Enterprise uses · Malware S0022: Uroburos Enterprise uses · Group G1048: UNC3886 Enterprise uses · Malware S1239: TONESHELL Enterprise
Mitigations

Mitigation direction

Mitigation Enterprise

M1037: Filter Network Traffic

Employ network appliances and endpoint software to filter ingress, egress, and lateral network traffic. This includes protocol-based filtering, enforcing firewall rules, and blocking or restricting traffic based on predefined conditions to limit adversary movement and data exfiltration. This mitigation can be implemented through the following measures:

Ingress Traffic Filtering:

- Use Case: Configure network firewalls to allow traffic only from authorized IP addresses to public-facing servers. - Implementation: Limit SSH (port 22) and RDP (port 3389) traffic to specific IP ranges.

Egress Traffic Filtering:

- Use Case: Use firewalls or endpoint security software to block unauthorized outbound traffic to prevent data exfiltration and command-and-control (C2) communications. - Implementation: Block outbound traffic to known malicious IPs or regions where communication is unexpected.

Protocol-Based Filtering:

- Use Case: Restrict the use of specific protocols that are commonly abused by adversaries, such as SMB, RPC, or Telnet, based on business needs. - Implementation: Disable SMBv1 on endpoints to prevent exploits like EternalBlue.

Network Segmentation:

- Use Case: Create network segments for critical systems and restrict communication between segments unless explicitly authorized. - Implementation: Implement VLANs to isolate IoT devices or guest networks from core business systems.

Application Layer Filtering:

- Use Case: Use proxy servers or Web Application Firewalls (WAFs) to inspect and block malicious HTTP/S traffic. - Implementation: Configure a WAF to block SQL injection attempts or other web application exploitation techniques.

Mitigation Enterprise

M1042: Disable or Remove Feature or Program

Disable or remove unnecessary and potentially vulnerable software, features, or services to reduce the attack surface and prevent abuse by adversaries. This involves identifying software or features that are no longer needed or that could be exploited and ensuring they are either removed or properly disabled. This mitigation can be implemented through the following measures:

Remove Legacy Software:

- Use Case: Disable or remove older versions of software that no longer receive updates or security patches (e.g., legacy Java, Adobe Flash). - Implementation: A company removes Flash Player from all employee systems after it has reached its end-of-life date.

Disable Unused Features:

- Use Case: Turn off unnecessary operating system features like SMBv1, Telnet, or RDP if they are not required. - Implementation: Disable SMBv1 in a Windows environment to mitigate vulnerabilities like EternalBlue.

Control Applications Installed by Users:

- Use Case: Prevent users from installing unauthorized software via group policies or other management tools. - Implementation: Block user installations of unauthorized file-sharing applications (e.g., BitTorrent clients) in an enterprise environment.

Remove Unnecessary Services:

- Use Case: Identify and disable unnecessary default services running on endpoints, servers, or network devices. - Implementation: Disable unused administrative shares (e.g., C$, ADMIN$) on workstations.

Restrict Add-ons and Plugins:

- Use Case: Remove or disable browser plugins and add-ons that are not needed for business purposes. - Implementation: Disable Java and ActiveX plugins in web browsers to prevent drive-by attacks.

Change history

Object version and sync metadata

The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates .

ATT&CK release
19.1
Object version
3.0
Created
Modified
Raw hash
e8723f9217491d83...
Imported snapshots across ATT&CK releases (1)
Release Bundle imported Object version Modified Status Raw hash
19.1 3.0 Current bundle e8723f921749…
Raw source

Mirrored ATT&CK source object

The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.

Open mirrored raw JSON Open MITRE-hosted copy
Source references

External references and citations

MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.

  1. [1]
    Hartrell cd00r 2002

    Hartrell, Greg. (2002, August). Get a handle on cd00r: The invisible backdoor. Retrieved October 13, 2018.

    Open source URL
  2. [2]
    Cisco Synful Knock Evolution

    Graham Holmes. (2015, October 8). Evolution of attacks on Cisco IOS devices. Retrieved October 19, 2020.

    Open source URL
  3. [3]
    Mandiant - Synful Knock

    Bill Hau, Tony Lee, Josh Homan. (2015, September 15). SYNful Knock - A Cisco router implant - Part I. Retrieved November 17, 2024.

    Open source URL
  4. [4]
    Cisco Blog Legacy Device Attacks

    Omar Santos. (2020, October 19). Attackers Continue to Target Legacy Devices. Retrieved October 20, 2020.

    Open source URL
  5. [5]
    Bleeping Computer - Ryuk WoL

    Abrams, L. (2021, January 14). Ryuk Ransomware Uses Wake-on-Lan To Encrypt Offline Devices. Retrieved February 11, 2021.

    Open source URL
  6. [6]
    AMD Magic Packet

    AMD. (1995, November 1). Magic Packet Technical White Paper. Retrieved February 17, 2021.

    Open source URL
  7. [7]
    mitre-attack T1205
    Open source URL
Source and licensing

Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.

Official MITRE ATT&CK site Official STIX data repository MITRE ATT&CK terms of use