High Number of Unique Remote Network Connections

Ankit Mehta@Secvyn

•updated Jun 12, 2026•0•0•6

Detects a device making an unusually high number of unique outbound network connections to different remote IP addresses within a short time frame (5 minutes). This behavior can indicate various malicious activities such as network scanning, botnet activity, or data exfiltration to multiple external hosts.