Outbound Connection to Suspicious Port Detected by Tetragon

Austin Mundy@letitgo90

•updated Apr 8, 2026•1•0•133

Detects TCP connections to ports commonly associated with reverse shells, C2 frameworks, and attacker tooling, as observed by Tetragon eBPF kernel-level network monitoring. After initial container compromise, attackers establish outbound connections on non-standard ports to maintain command and control. Tetragon provides full process context (binary, pod, namespace, parent process) tied to the network event, enabling high-fidelity correlation.