Sunturai
Back to results
InformationalSplunk security contentRaven Tait +1

Windows Network Connection From Program In Suspect Location

The following analytic detects network connections from processes running out of suspicious Windows directories such as Recycle Bin, Public, PerfLogs, systemprofile, Fonts, IME, and Addins paths. This activity is…

Description

The following analytic detects network connections from processes running out of suspicious Windows directories such as Recycle Bin, Public, PerfLogs, systemprofile, Fonts, IME, and Addins paths. This activity is significant because malware often executes from writable or unusual directories while communicating with external infrastructure. If confirmed malicious, the process may represent command-and-control, staging, or data exfiltration activity from a compromised endpoint.

Detection logic

Detection requirements

Platform
LinuxmacOSWindows

The rule states no platform. This is derived from the ATT&CK technique it maps to.

Log source category
sysmon_eventid_3

Known benign triggers

  • Some legitimate system or security tools may run from these folders and create network connections. Review and allow trusted processes to reduce false positives.

Detections can measure how the public catalogue is used — which detections people look for, and which pages bring them here. It sets a cookie that recognises this browser for 180 days. It is never linked to an account and never follows you to other sites. Privacy notice