Suspicious Process Network Connection to Cloud Storage

Bhojraj Joshi@cybrbhojrajjoshi

•updated Apr 22, 2026•5•0•330

This rule detects suspicious processes (winupdate.exe, windows.exe, svchost.exe, system32.exe) initiating network connections from unusual directories (Downloads, Public, System32) to known cloud storage providers (Amazon AWS, DigitalOcean, Azure Blob Storage) or over port 443. This behavior could indicate data exfiltration, command and control activity, or malware communication.