Suspicious IIS Worker Outbound C2 on Non-Standard Port

Kaung Khant Ko@kaungkhantko

•updated Jun 9, 2026•1•0•13

This rule detects suspicious outbound network connections initiated by an IIS worker process (w3wp.exe) to non-standard ports. This behavior can indicate a web shell or other compromise establishing Command and Control (C2) communication, potentially for data exfiltration or further malicious activity. The rule specifically looks for successful connections where the remote port is not commonly used for web traffic (80 or 443).