Outbound Network Connections to Non-Standard Ports

Vignesh S@vigneshh

•updated yesterday•2•0•5

This detection identifies outbound IPv4 and IPv6 network connections to non-standard ports that may indicate suspicious network activity, unauthorized communication, or potential command-and-control (C2) traffic. It excludes commonly used ports for DNS (53), HTTP (80), HTTPS (443), and alternate web services (8000, 8080), along with private, loopback, link-local, multicast, and documentation-only IP ranges to reduce noise.