Suspicious Wordpad Outbound Connections

SigmaHQ Detections@sigmaHQ

•updated Nov 1, 2024•0•31

Detects a network connection initiated by "wordpad.exe" over uncommon destination ports. This might indicate potential process injection activity from a beacon or similar mechanisms.