Whispers Through the Firewall: Data Exfiltration and C2 with Port Knocking

Port knocking is a stealthy network authentication technique (T1205.001) in which a client sends a specific sequence of connection attempts (or “knocks”) to closed ports on a server. When the correct sequence is received, the server dynamically opens a port or triggers an action, enabling concealed access or communication. Saucepot C2 elevates the port knocking technique to a new level. Instead of using destination ports (DstPorts) in TCP sessions as knock sequences, it leverages source ports (SrcPorts), also known as ephemeral ports. This approach allows data exfiltration even in highly restrictive firewall environments where only a single outbound port, such as port 443, is allowed.