Network Connection Initiated by Calculator Application
This rule detects instances where the calculator application (calc.exe) initiates a network connection. This behavior is highly unusual for a standard calculator application and could indicate malicious activity, such as an adversary using calc.exe as a proxy for network communication or injecting malicious code into it.
Microsoft Sentinel (KQL)
