Commonly Used Port
Technique · ATTACK:ics:T0885
Attributed source ↗ · Plaintext record · Complete record and assertions JSON
Inspect structured metadata and provenance
{
"id": "ATTACK:ics:T0885",
"title": "Commonly Used Port",
"type": "Technique",
"source_url": "https://attack.mitre.org/techniques/T0885",
"snapshot": "ics-attack-20.0.json",
"status": "active",
"rights": "Source metadata only; source notices retained; no operational prose or payloads",
"review_status": "machine-extracted; source-specific checks passed, editorial review pending",
"stix_id": "attack-pattern--e6c31185-8040-4267-83d3-b217b8a92f07",
"external_id": "T0885",
"domain": "ics",
"created": "2020-05-21T17:43:26.506Z",
"modified": "2026-10-13T17:48:36.649Z",
"version": "1.1",
"aliases": [
],
"tactics": [
"command-and-control"
],
"source_references": [
]
}Explicit source assertions (10)
First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.
ATTACK:ics:M0804 → mitigates → ATTACK:ics:T0885
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--0a5d2136-e1f5-4a54-be64-a558f918bf0d
ATTACK:ics:C0063 → uses → ATTACK:ics:T0885
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--5152ea91-af3f-4317-81ca-b3cf910b471a
CERT PolskaATTACK:ics:C0028 → uses → ATTACK:ics:T0885
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--6573327e-3757-424e-8570-04ffe7d5d0e2
Booz Allen HamiltonATTACK:ics:S1165 → uses → ATTACK:ics:T0885
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--69d19946-72fb-40ce-90fb-0757df8353b5
Dragos FROSTYGOOP 2024ATTACK:ics:M0931 → mitigates → ATTACK:ics:T0885
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--7dedeb73-ef90-4282-a635-cc37326773af
University of Birmingham C2ATTACK:ics:S1009 → uses → ATTACK:ics:T0885
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--8b2d82aa-75fc-4d6d-bb4b-9f600bd211fd
MDudek-ICSATTACK:ics:S0603 → uses → ATTACK:ics:T0885
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--bcece7ce-91b5-40b3-b87a-25cab3600e5c
Nicolas Falliere, Liam O Murchu, Eric Chien February 2011ATTACK:ics:M0930 → mitigates → ATTACK:ics:T0885
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--bde941c6-2ca0-4f94-9336-027e7eee15a1
ATTACK:ics:M0942 → mitigates → ATTACK:ics:T0885
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--ca64a927-f050-41b3-80d3-93d22cdef26a
ATTACK:ics:G1027 → uses → ATTACK:ics:T0885
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--cf125e14-158c-4bd2-9d86-61f349704c99
CISA-AA26-097A