Outbound Network Connection Initiated By Microsoft Dialer
Detects outbound network connections initiated by `dialer.exe`, an outdated Microsoft utility. This process is known to be targeted by info-stealers for process injection and used to establish command and control (C2) connections, with Rhadamanthys being a common example. The rule filters out connections to common local and private IP ranges to reduce false positives.
Sigma
