Potentially Suspicious Malware Callback Communication
Detects programs that connect to known malware callback ports based on statistical analysis from two different sandbox system databases. This rule identifies outbound network connections to a specific list of destination ports that have been historically associated with malware command and control (C2) communications. It filters out connections to local IP ranges and common system directories to reduce false positives.
Sigma
