Suspicious Process Connecting on Non-Standard External Port

Rudra Verma@Rudraverma

•updated Jun 2, 2026•3•0•16

This rule detects suspicious processes (e.g., powershell.exe, cmd.exe, mshta.exe) making outbound network connections to public IP addresses on non-standard ports. This behavior can indicate command and control (C2) communication or data exfiltration attempts, as adversaries often use non-standard ports to evade detection.