Uncommon Network Connection on Port 18789

Jeremy Goldstein@jeremys1

•updated Apr 22, 2026•14•1•510

This rule detects network connections (both inbound and outbound) on TCP/UDP port 18789, excluding connections initiated by processes from well-known publishers like Microsoft, Apple, and Google. This port is not commonly used by legitimate applications and could indicate the presence of custom malware, command and control (C2) communication, or other unauthorized network activity.