Outbound Connection to High Non-Standard Remote Port

Vignesh S@vigneshh

•updated today•0•0•1

Detects outbound IPv4 and IPv6 connections from endpoints to public IP addresses on high-numbered ports (1023 and above), excluding private, reserved IP ranges and known noisy processes. Command-and-control tools, malware and tunneling activities may use uncommon ports to evade network monitoring. Connections are aggregated by endpoint, process, remote IP and port to identify suspicious communication patterns. Legitimate applications, custom services and administrative tools may also use these ports, so triage based on process context, destination reputation and connection frequency.