RedTail masqueraded process listening on known high ports

Arnold Chan@slaz

•updated Sep 11, 2026•1•0•2

Detects specific suspicious processes (identified by hash or path) initiating a listening network connection on non-standard ports typically associated with honeypot captures, specifically referencing Cowrie-related paths or known malicious samples.