High Volume Outbound Connections to Non-RFC1918 IPs on Common RAT Ports
This rule detects a high volume of outbound network connections (20 or more within an hour) from a single device and process to non-RFC1918 IP addresses on ports commonly associated with Remote Access Trojans (RATs) or Command and Control (C2) communication. The ports monitored include 443, 8443, 8080, 80, 4444, 5555, 6666, and 7777. This pattern can indicate a compromised host attempting to establish C2 with an external adversary.
Microsoft Sentinel (KQL)
