ATT&CK T1205 - Possible Port Knocking Sequence

Darshan Thummar@Mighty

•updated Jun 10, 2026•1•0•6

This rule detects a possible port knocking sequence, which is a method of externally opening ports on a firewall by generating a sequence of connection attempts to a set of closed ports. The rule specifically looks for 5 TCP SYN packets from the same source IP within a 5-second window to any port on the home network, indicating a potential port knocking attempt.