LOLBin Outbound Network Connection to Public IP (T1218)
This rule detects known Living-off-the-Land Binaries (LOLBins) initiating outbound network connections to specific non-standard or commonly suspicious ports (8080, 8443, 4444, 1337, 1234). The rule excludes private/loopback network traffic and common Microsoft-related domains to reduce noise. Such behavior is often indicative of malicious activity, including C2 communication or unauthorized file downloads via trusted system processes.
Microsoft Sentinel (KQL)
