Ports/Protocols

20/21 - File Transfer Protocol (FTP)

Used for file transfers, can connect to products or services utilizing FTP to send, receive, or view files.

22 - Secure Shell (SSH)

Remote host conection, a common use case being servers with SSH open. It is encrypted so data in transit is safe.

23 - Telnet

Legacy remote host connection, sends data (including credentials) in cleartext. Should not be seen on modern networks — flag as suspicious.

25 - Simple Mail Transfer Protocol (SMTP)

Server-to-server mail delivery. Common target for phishing infrastructure and outbound spam/exfiltration over cleartext.

53 - Domain Name System (DNS)

Resolves domain names to IP addresses. Frequently abused for tunneling, C2 beaconing, and data exfiltration — watch for high query volume, long subdomains, and TXT record misuse.

67/68 - Dynamic Host Configuration Protocol (DHCP)

Assigns IP addresses to hosts on the network. Useful for correlating an IP back to a specific device during an investigation.

69 - Trivial File Transfer Protocol (TFTP)

Lightweight, unauthenticated file transfer. Often used by network gear — unexpected traffic can indicate config theft or malware staging.

80 - Hypertext Transfer Protocol (HTTP)

Unencrypted web traffic. Credentials and payloads are visible in plaintext, making it a common vector for phishing pages and malware delivery.

88 - Kerberos

Authentication in Active Directory environments. Central to attacks like Kerberoasting, AS-REP roasting, and Golden/Silver Ticket abuse.

110 - Post Office Protocol v3 (POP3)

Legacy mail retrieval, cleartext. Rare in modern environments — suspicious if seen leaving the network.

123 - Network Time Protocol (NTP)

Synchronizes system clocks. Accurate time is critical for log correlation; NTP has also been abused for reflection/amplification DDoS.

135 - Microsoft RPC (MS-RPC)

Windows remote procedure calls. Used for legitimate management but also for lateral movement (e.g. WMI, DCOM). Should not be exposed to the internet.

137/138/139 - NetBIOS

Legacy Windows name resolution and file sharing. Common in LLMNR/NBT-NS poisoning attacks to capture hashes.

143 - Internet Message Access Protocol (IMAP)

Mail retrieval with folder sync. Cleartext version — monitor for credential brute force and unusual mailbox access.

161/162 - Simple Network Management Protocol (SNMP)

Manages and monitors network devices. Weak community strings ("public"/"private") can leak device configuration and inventory.

389 - Lightweight Directory Access Protocol (LDAP)

Queries directory services like Active Directory. Cleartext — recon activity (e.g. BloodHound, LDAP enumeration) is a common indicator.

443 - HTTP Secure (HTTPS)

Encrypted web traffic. The bulk of modern C2 and phishing hides in HTTPS — pivot on JA3/JA4, certificates, and destination reputation instead of payload contents.

445 - Server Message Block (SMB)

Windows file sharing. Heavily abused for lateral movement, ransomware propagation (e.g. EternalBlue), and credential relay. Should never be exposed externally.

465/587 - SMTP Submission (SMTPS/STARTTLS)

Authenticated client-to-server mail submission. Watch for compromised mailbox accounts sending outbound spam or phishing.

500 / 4500 - IPSec / IKE

VPN tunnel negotiation. Useful when investigating site-to-site or remote access VPN activity.

514 - Syslog

Log forwarding to a central collector or SIEM. Loss of syslog traffic from a host can indicate the host is down — or that logging was tampered with.

636 - LDAPS

LDAP over TLS. Encrypted equivalent of 389 — preferred for directory queries.

993 - IMAP over TLS

Encrypted IMAP. Monitor for suspicious logins, impossible travel, and mailbox rules created by attackers.

995 - POP3 over TLS

Encrypted POP3. Same monitoring concerns as IMAPS but rarer in enterprise environments.

1433 / 1434 - Microsoft SQL Server

Database traffic. Externally exposed SQL is a frequent breach vector; internally, watch for xp_cmdshell usage and unusual query volume.

3306 - MySQL / MariaDB

Database traffic. Same exposure concerns as MSSQL — should not be internet-facing.

3389 - Remote Desktop Protocol (RDP)

Windows graphical remote access. One of the most abused protocols for initial access and lateral movement — brute force and credential stuffing are constant.

4444 - Common Malware / Metasploit Default

Default listener port for Metasploit's windows/meterpreter/reverse_tcp. Any traffic to/from 4444 warrants immediate investigation.

5432 - PostgreSQL

Database traffic. Watch for exposed instances, weak auth, and abuse of COPY PROGRAM for RCE.

5985 / 5986 - Windows Remote Management (WinRM)

Remote PowerShell over HTTP/HTTPS. Common lateral movement vector — legitimate admin use should be baselined so anomalies stand out.

8080 / 8443 - HTTP / HTTPS Alternate

Common alternate web ports for proxies, admin panels, and dev servers. Frequently used by exposed management interfaces and C2.

---