Detection catalogue

Explore published rules with transparent provenance, licensing, and ATT&CK mappings.

detections

Loading detections…

Suspicious Wordpad Outbound Connections

Detects a network connection initiated by "wordpad.exe" over uncommon destination ports. This might indicate potential process injection activity from a beacon or similar mechanisms.

ATT&CK coverage

This detection is not mapped to any ATT&CK technique.

Detection requirements

Log source product: windows
Log source category: network_connection

Detection logic

Published to signed-in readers

The query as its source wrote it, its canonical form, and the content hash that pins this exact revision.