ZD POLICY TLS outbound on unusual port - possible covert channel

Ali AlEnezi@site

•updated Sep 15, 2026•1•0•1

Detects established TLS outbound connections to external networks on ports other than standard ones (e.g., 443, 465, 587, 993, 995, 8443, 9443). This behavior may indicate a covert C2 channel or unauthorized data exfiltration attempting to bypass standard firewall controls.