RedTail masqueraded process listening on known high ports

Arnold Chan@slaz

•updated Sep 11, 2026•0•0•1

Detects specific suspicious processes (identified by hash or path) initiating a listening network connection on non-standard ports typically associated with honeypot captures, specifically referencing Cowrie-related paths or known malicious samples.