Network Connection to Suspicious IP Ranges

Bhojraj Joshi@cybrbhojrajjoshi

•updated Apr 29, 2026•5•0•295

This rule detects outbound network connections from endpoints to specific, potentially suspicious, IPv4 address ranges (162.220.234.0/24 and 162.220.232.0/24). Such connections could indicate command and control (C2) activity, data exfiltration, or communication with malicious infrastructure.