Network Connection From Suspicious Windows Location

SigmaHQ Detections@sigmaHQ

•updated Aug 23, 2024•2•0•20

Detects a network connection initiated by programs or processes running from suspicious or uncommon file system locations. This often indicates malware execution or persistence from areas not typically used by legitimate applications for network communication.