Explorer.exe Outbound Connection to C2 Ports

Taylor Parizo@axelarator

•updated Mar 27, 2026•6•1•123

Detects outbound network connections initiated by explorer.exe to specific ports (7077 or 62046). This activity is associated with the FAUX#ELEVATE RAT component (RuntimeHost.exe) injecting into explorer.exe for command and control (C2) communications. The rule filters out connections to internal RFC1918 subnets to reduce false positives.