Outbound LLM API Calls (Anthropic, DeepSeek, Zhipu, xAI) Alongside Scanning
Detects processes that make outbound API calls to known Large Language Model (LLM) domains while simultaneously performing high-volume network connection attempts or scanning-like fan-out activity across multiple public IP addresses.
Microsoft Sentinel (KQL)
