Anomalous vLLM Outbound Connection (CVE-2026-22778)
Detects anomalous outbound network connections originating from the Python/vLLM process to irregular ports or cloud metadata IPs. This behavior may indicate command-and-control establishment, secondary staging, or cloud metadata pivoting following a successful CVE-2026-22778 exploit.
Microsoft Sentinel (KQL)
