ATT&CK T1219 - Metasploit Default Handler Port

Darshan Thummar@Mighty

•updated Jun 10, 2026•0•0•1

This rule detects network connections to TCP port 4444, which is a commonly used default handler port for Metasploit, a popular penetration testing framework. The rule specifically looks for the initial SYN packet (flags:S) of a TCP connection from any source to any destination on port 4444 within the home network. This activity is often associated with command and control (C2) communication or reverse shells established by attackers using Metasploit.