Uncommon Top-Level Domain Network Connection by Non-Browser Process

F S@Fsdr

•updated Jul 28, 2026•22•0•36

Detects network connections to uncommon or suspicious top-level domains (TLDs) initiated by processes other than standard web browsers. The rule filters out known browser processes and analyzes network traffic patterns, including connection count and prevalence across the fleet, to identify potentially anomalous or malicious C2 activity.