TCP Port 7080 – empowerid

About TCP Port 7080

Port 7080 is registered with the Internet Assigned Numbers Authority (IANA) for empowerid. The IANA description reads: ‘EmpowerID Communication’. This port is referenced in 18 IDS rules and exhibits high malware activity in monitored traffic.

IDS Rule References

18 IDS / security rules reference TCP port 7080. Presence in IDS rules does not mean traffic on this port is malicious. These are patterns security tools monitor.

Rule categories (top 2): command-and-control (15), trojan-activity (3).

Sample rule descriptions for TCP port 7080:

• ET MALWARE W32.Geodo/Emotet Checkin
• ET MALWARE W32/Emotet CnC Beacon 1
• ET MALWARE Win32/Emotet CnC Activity (POST) M5
• ET MALWARE Win32/Emotet CnC Activity (POST) M6
• ET MALWARE Win32/Emotet CnC Activity (POST) M7

Malware Activity

Malware activity is frequently observed on this port.

18 of 18 IDS rules for TCP port 7080 involve malware activity.

Families observed (top 1): Emotet (18).

Data Sources

This information is compiled from: IANA Service Name and Transport Protocol Port Number Registry, Emerging Threats Open Ruleset (BSD 2-Clause / GPLv2 per SID range), and MITRE ATT&CK (Apache 2.0).