Suspicious Outbound Network Connection to Known C2 IP and Ports

nomit vyas@xoxo

•updated Jun 24, 2026•0•0•6

This rule detects outbound network connections from devices to a specific remote IP address (62.102.148.212) on a set of suspicious remote ports (37393, 45839, 38471, 12345, 4444, 5555). This pattern is indicative of potential command and control (C2) communication or data exfiltration to a known malicious infrastructure.