Emotet Network Connection Indicators

Ankit Mehta@Secvyn

•updated Jun 17, 2026•0•0•11

This rule detects network connections from common user applications (explorer.exe, outlook.exe, word.exe) to specific remote ports (8080, 443, 445) where the remote URL contains known Emotet indicators. This helps identify potential Emotet malware command and control (C2) or dropper activity.