Endgame - Direct IP HTTPS Check-ins (T1071.001)

Ibrahim Saud@tektrix

•updated Jun 20, 2026•1•0•5

Detects suspicious network activity where processes like wscript.exe or rundll32.exe initiate HTTPS (port 443) connections directly to raw IP addresses, bypassing DNS. This behavior is often associated with malware like SocGholish for rapid command and control check-ins.