RDP-over-TLS on non-standard high ports linked to SilkParasite infra

Ibrahim Saud@tektrix

•updated Sep 20, 2026•0•0•2

Detects outbound TLS-encrypted network traffic directed towards known SilkParasite infrastructure using non-standard high ports commonly associated with RDP-over-TLS (NLA). The rule identifies potential Command and Control (C2) activity by flagging connections to suspicious IP/port combinations typical of this adversary cluster.