Sigma Watch is free and independent. If it saves you time, keep it running. ☕ Buy me a coffee
SigmaWatch
ATT&CK technique

T1205.001

Port Knocking

StealthPersistenceCommand and Control 2 detections found
View on MITRE ATT&CK →

Detection rules

Source Rule Status Updated
elastic Unusual Linux Network Port Activity production 2026-09-18
elastic Potential Linux Reverse Connection through Port Knocking deprecated 2024-02-22