Inbound Connection to Internet-Facing Device on Non-Standard Ports

Information hacker@Informationhacker

•updated Jan 16, 2026•22•0•148

This rule detects inbound network connections to internet-facing devices on ports other than 80 (HTTP) or 443 (HTTPS). This could indicate an adversary attempting to establish command and control, exfiltrate data, or exploit services running on non-standard ports.