RDP-over-TLS/NLA on non-standard high ports linked to SilkParasite infra

Ibrahim Saud@tektrix

•updated Sep 20, 2026•0•0•3

Detects Remote Desktop Protocol (RDP) traffic occurring over non-standard high ports (64350, 64330, 65535, 65111, 61256), which is indicative of SilkParasite C2 activity or potentially malicious lateral movement attempting to bypass standard port monitoring.