TCP Port 447 – ddm-dfm

About TCP Port 447

Port 447 is registered with the Internet Assigned Numbers Authority (IANA) for ddm-dfm. The IANA description reads: ‘DDM-Distributed File Management’. This port is referenced in 5 IDS rules and exhibits high malware activity in monitored traffic.

IDS Rule References

5 IDS / security rules reference TCP port 447. Presence in IDS rules does not mean traffic on this port is malicious. These are patterns security tools monitor.

Rule categories (top 2): trojan-activity (4), command-and-control (1).

Sample rule descriptions for TCP port 447:

• MALWARE-CNC Win.Trojan.Trickbot self-signed certificate exchange
• MALWARE-CNC Win.Trojan.Trickbot self-signed certificate exchange
• MALWARE-CNC Win.Trojan.Trickbot self-signed certificate exchange
• MALWARE-CNC Win.Trojan.Trickbot self-signed certificate exchange
• ET MALWARE Win32/Ramnit Checkin

Malware Activity

Malware activity is frequently observed on this port.

5 of 5 IDS rules for TCP port 447 involve malware activity.

Families observed (top 2): Trickbot (4), Ramnit (1).

Data Sources

This information is compiled from: IANA Service Name and Transport Protocol Port Number Registry, Emerging Threats Open Ruleset (BSD 2-Clause / GPLv2 per SID range), Snort Community Rules (GPLv2), and MITRE ATT&CK (Apache 2.0).