TrafficRedirector backconnect proxy tunnel - persistent outbound relay session

Emiliano Mema@Nosalva

•updated Aug 25, 2026•1•0•4

Detects persistent outbound TCP connections to external infrastructure, which is indicative of a potential backconnect proxy or C2 communication tunnel. The rule uses a threshold to filter out transient connections.