ATT&CK T1219 - RAT C2 Common Port 1337

Darshan Thummar@Mighty

•updated Jun 10, 2026•0•0•4

This rule detects TCP network connections originating from the internal network ($HOME_NET) to any external destination on port 1337. The detection is specifically for the initial SYN packet of a TCP handshake (flags:S) and is categorized as 'trojan-activity'. Port 1337 is commonly associated with Remote Access Trojans (RATs) for Command and Control (C2) communications, aligning with MITRE ATT&CK technique T1219.