Anomalous Process Egress - Pair Probability (Path-Keyed) - Threat Hunting
Pairs the connecting process against the remote destination port and ranks by lift, meaning how much less often the two co-occur than their individual frequencies would predict. The target shape is a process with a large network baseline that has touched a given service port once or twice: a browser or office application reaching SMB, RDP, SSH or WinRM, or an observability agent speaking a protocol outside its purpose. Those pairings are lateral movement or credential access wearing a familiar process name. The process is keyed on normalized directory plus image name rather than name alone, so distinct binaries sharing a name stay separate and any hit is attributable to a specific file. The kernel-mode System process is preserved by falling back to the image name when no path exists, because System on SMB is meaningful client activity and dropping it would be a real coverage loss. PORT HANDLING Ephemeral ports are cut. On inbound connections the remote port is drawn from the dynamic range, so every one appears unique and produces tens of thousands of meaningless rare pairings; an inbound source port carries no information. Universal ports are excluded: HTTPS, HTTP and DNS, plus the discovery and broadcast protocols (mDNS, LLMNR, NetBIOS, SSDP, WS-Discovery) and optionally LDAP and Global Catalog. Their baselines are large enough that any process which rarely touches them floats to the top on arithmetic alone, and "this application made one HTTPS call" is not a finding. WATCH FOR SHARED BASELINES When a port exists to serve one application, that port's baseline and the application's baseline are the same flows. Any third process meeting that port then produces the largest possible denominator and ranks first while being entirely benign. Compare the port's total against the dominant process's total; if they match closely, treat pairings on that port as suspect ranking rather than signal. TUNING Thresholds are the port baseline, the process baseline, and the pair
Cortex XDR
