Unexpected Network Connection from System Process [splunk-sysmon]

Threat actors may abuse legitimate system processes that typically lack network functionality to perform malicious network activity, helping evade detection and blend in with normal system behavior. This technique is often associated with process injection or masquerading, where code is executed within trusted processes to establish command-and-control (C2) channels or exfiltrate data. This use case detects instances where non-networking system processes (e.g., conhost.exe, lsass.exe, wininit.exe) are observed initiating network connections, which may indicate process injection, covert C2 activity, or execution of malicious payloads under trusted process names.