Outbound Network Connection to Newly Observed IP Address
This rule detects outbound network connections to IP addresses that have been observed for the first time within the last 24 hours. It specifically excludes connections to private IP address ranges (RFC1918). The detection relies on correlating current network connection events with historical 'first seen' data for IP addresses from an entity graph.
YARA-L
