All Detections

Suspicious User-Writable Process Connection To TCP 8443

avatar
Luís Marques@remotecodeexecution
updated today000

Detects processes executing from user-writable locations connecting to TCP 8443, a behavior reported for the BraZetsu WebSocket backdoor.

Sigma