C2 Traffic Over Unusual UDP Ports by Interpreted Languages

Ibrahim Saud@tektrix

•updated Jun 20, 2026•0•0•4

This rule detects outbound UDP network traffic to high ports (greater than 1024, excluding common ports like 5353, 5355, 3389) initiated by interpreted language processes such as Python, Node.js, PowerShell, or WScript. This pattern can be indicative of Command and Control (C2) communication, particularly associated with botnet DHT (Distributed Hash Table) or custom C2 routing mechanisms.