Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088(Citation: Symantec Elfin Mar 2019) or port 587(Citation: Fortinet Agent Tesla April 2018) as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.

Adversaries may also make changes to victim systems to abuse non-standard ports. For example, Registry keys and other configuration settings can be used to modify protocol and port pairings.(Citation: change_rdp_port_conti)
Non-Standard Port
source_name: mitre-attack  url: https://attack.mitre.org/techniques/T1571  external_id: T1571     source_name: University of Birmingham C2  description: Gardiner, J.,  Cova, M., Nagaraja, S. (2014, February). Command & Control Understanding, Denying and Detecting. Retrieved April 20, 2016.  url: https://arxiv.org/ftp/arxiv/papers/1408/1408.1136.pdf     source_name: Symantec Elfin Mar 2019  description: Security Response attack Investigation Team. (2019, March 27). Elfin: Relentless Espionage Group Targets Multiple Organizations in Saudi Arabia and U.S.. Retrieved April 10, 2019.  url: https://www.symantec.com/blogs/threat-intelligence/elfin-apt33-espionage     source_name: change_rdp_port_conti  description: The DFIR Report. (2022, March 1). "Change RDP port" #ContiLeaks. Retrieved March 1, 2022.  url: https://twitter.com/TheDFIRReport/status/1498657772254240768     source_name: Fortinet Agent Tesla April 2018  description: Zhang, X. (2018, April 05). Analysis of New Agent Tesla Spyware Variant. Retrieved November 5, 2018.  url: https://www.fortinet.com/blog/threat-research/analysis-of-new-agent-tesla-spyware-variant.html     