Low Frequency External Network Connections

Shadows VMB@Vemorian_Mort

•updated Jul 15, 2026•8•1•11

This rule monitors and aggregates external network connections originating from a specific host. It specifically highlights connections to external domains or IPs that have a low frequency (1-10 connections), which may indicate beaconing activity, command and control (C2) communication, or low-and-slow data exfiltration attempts.