Outbound Connection to Non-Standard Remote Port
Detects outbound IPv4 and IPv6 connections from endpoints to public addresses on ports other than DNS (53), HTTP (80), HTTPS (443), 8000. Command-and-control tools and tunnels often use uncommon ports to avoid web-focused filtering. Private, loopback, link-local, multicast and documentation ranges are excluded, and repeated connections are grouped by endpoint, process, remote IP and port. Custom apps and admin tools also use these ports, so triage by process, destination reputation and how rare the destination is.
CQL
