Process Contacting Multiple Unique Domains

Danny Y@zendannyy

•updated Dec 26, 2025•1•0•49

Detects processes contacting multiple different domains (potential network enumeration OR C2 rotation) This requires correlation engine of some kind. Logic: Same user/host contacts 5+ different domains in 10 minute span