Potential C2 Communications over Non-Standard Ports
This rule detects potential command and control (C2) communications over non-standard ports. It identifies devices that make a high number of network connections to distinct remote IP addresses on ports other than common ones (80, 443, 53, 22, 21, 25, 110, 143, 993, 995) and not to private IP ranges. The rule aggregates connection counts and distinct remote IPs over 15-minute intervals and flags activity where there are more than 30 connections and more than 2 distinct remote IPs.
Microsoft Sentinel (KQL)
