Suspicious Outbound Connections to Code/Text Sharing Sites

Ankit Mehta@Secvyn

•updated Jun 30, 2026•3•0•6

This rule detects processes making three or more successful outbound network connections within an hour to known code or text sharing sites like Pastebin, GitHub, or Gist. This activity can be indicative of data exfiltration, command and control (C2) communication, or staging of malicious code.