The TLS version of the Intel AMT management interface, available once AMT has a certificate.
IANA registers 16993 to Intel as amt-soap-https. It carries the same SOAP/WS-Management interface as 16992 with TLS, and is the port AMT uses once it is provisioned in TLS mode; 16995 is the matching encrypted redirection port. Like 16992 it is answered by the Management Engine independently of the installed OS, so it survives reinstalls and appears on machines whose owners do not know AMT is enabled.
Do not expose
TLS fixes the eavesdropping problem, not the exposure problem: this is out-of-band control of the hardware, historically vulnerable to firmware-level auth bypass. Keep it on a management network.
$ openssl s_client -connect TARGET:16993 -servername TARGET </dev/null 2>/dev/null | openssl x509 -noout -subject -issuer -datesSeen this on your network? Beige Box scans your Wi-Fi and shows every open port on every device — and its Ports tool links straight back here.
Get Beige Box →also available as JSON · Markdown
Corrections or a missing port? Reply @rimrocksystems.