{
  "port": 16993,
  "protocol": "tcp",
  "service": "Intel AMT SOAP/HTTPS",
  "oneLiner": "The TLS version of the Intel AMT management interface, available once AMT has a certificate.",
  "whatItIs": "IANA registers 16993 to Intel as amt-soap-https. It carries the same SOAP/WS-Management interface as 16992 with TLS, and is the port AMT uses once it is provisioned in TLS mode; 16995 is the matching encrypted redirection port. Like 16992 it is answered by the Management Engine independently of the installed OS, so it survives reinstalls and appears on machines whose owners do not know AMT is enabled.",
  "exposure": {
    "verdict": "never",
    "note": "TLS fixes the eavesdropping problem, not the exposure problem: this is out-of-band control of the hardware, historically vulnerable to firmware-level auth bypass. Keep it on a management network."
  },
  "checkCommand": "openssl s_client -connect TARGET:16993 -servername TARGET </dev/null 2>/dev/null | openssl x509 -noout -subject -issuer -dates",
  "links": [
    {
      "title": "IANA Service Name and Transport Protocol Port Number Registry — 16993 (amt-soap-https)",
      "url": "https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml?search=16993",
      "kind": "iana"
    },
    {
      "title": "INTEL-SA-00075 — AMT/ISM/SBT escalation of privilege (CVE-2017-5689)",
      "url": "https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00075.html",
      "kind": "official-docs"
    },
    {
      "title": "Device Management Toolkit — deployment (formerly Intel Open AMT Cloud Toolkit)",
      "url": "https://github.com/device-management-toolkit/deployment",
      "kind": "github"
    }
  ]
}